From f30c05e68431dce92ea01aa8c665a275ff2507a4 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 16 Apr 2019 21:11:00 +0200 Subject: [PATCH] smb: remove C implementation Now that Rust is mandatory it is obsolete. Ticket: #2849 --- src/Makefile.am | 2 - src/app-layer-detect-proto.c | 10 +- src/app-layer-parser.c | 7 +- src/app-layer-protos.c | 4 - src/app-layer-protos.h | 1 - src/app-layer-smb.c | 2821 ---------------------------------- src/app-layer-smb.h | 171 --- src/app-layer-smb2.c | 692 --------- src/app-layer-smb2.h | 83 - src/detect-dce-iface.c | 17 - src/detect-engine-file.c | 1 - src/detect-engine-state.c | 1 - src/detect.c | 4 +- src/runmode-unittests.c | 1 - src/suricata.c | 1 - 15 files changed, 7 insertions(+), 3809 deletions(-) delete mode 100644 src/app-layer-smb.c delete mode 100644 src/app-layer-smb.h delete mode 100644 src/app-layer-smb2.c delete mode 100644 src/app-layer-smb2.h diff --git a/src/Makefile.am b/src/Makefile.am index a4a2289444..7cf6c6bddb 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -38,8 +38,6 @@ app-layer-htp-xff.c app-layer-htp-xff.h \ app-layer-modbus.c app-layer-modbus.h \ app-layer-parser.c app-layer-parser.h \ app-layer-protos.c app-layer-protos.h \ -app-layer-smb2.c app-layer-smb2.h \ -app-layer-smb.c app-layer-smb.h \ app-layer-smb-tcp-rust.c app-layer-smb-tcp-rust.h \ app-layer-smtp.c app-layer-smtp.h \ app-layer-nfs-tcp.c app-layer-nfs-tcp.h \ diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c index 3e75482ee2..780b386105 100644 --- a/src/app-layer-detect-proto.c +++ b/src/app-layer-detect-proto.c @@ -843,8 +843,6 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar printf(" alproto: ALPROTO_JABBER\n"); else if (pp_pe->alproto == ALPROTO_SMB) printf(" alproto: ALPROTO_SMB\n"); - else if (pp_pe->alproto == ALPROTO_SMB2) - printf(" alproto: ALPROTO_SMB2\n"); else if (pp_pe->alproto == ALPROTO_DCERPC) printf(" alproto: ALPROTO_DCERPC\n"); else if (pp_pe->alproto == ALPROTO_IRC) @@ -916,8 +914,6 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar printf(" alproto: ALPROTO_JABBER\n"); else if (pp_pe->alproto == ALPROTO_SMB) printf(" alproto: ALPROTO_SMB\n"); - else if (pp_pe->alproto == ALPROTO_SMB2) - printf(" alproto: ALPROTO_SMB2\n"); else if (pp_pe->alproto == ALPROTO_DCERPC) printf(" alproto: ALPROTO_DCERPC\n"); else if (pp_pe->alproto == ALPROTO_IRC) @@ -2470,7 +2466,7 @@ static int AppLayerProtoDetectTest09(void) f.protomap = FlowGetProtoMapping(IPPROTO_TCP); const char *buf = "|fe|SMB"; - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, buf, 8, 4, STREAM_TOCLIENT); + AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, buf, 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since @@ -2482,14 +2478,14 @@ static int AppLayerProtoDetectTest09(void) FAIL_IF(alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1); FAIL_IF(alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL); FAIL_IF(alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL); - FAIL_IF(alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_SMB2); + FAIL_IF(alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_SMB); bool rdir = false; uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, pm_results, &rdir); FAIL_IF(cnt != 1); - FAIL_IF(pm_results[0] != ALPROTO_SMB2); + FAIL_IF(pm_results[0] != ALPROTO_SMB); AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 1b8fba9ab5..27f6c208f3 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -46,10 +46,9 @@ #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" -#include "app-layer-smb.h" -#include "app-layer-smb2.h" #include "app-layer-dcerpc.h" #include "app-layer-dcerpc-udp.h" +#include "app-layer-smb-tcp-rust.h" #include "app-layer-htp.h" #include "app-layer-ftp.h" #include "app-layer-ssl.h" @@ -1481,11 +1480,9 @@ void AppLayerParserRegisterProtocolParsers(void) RegisterHTPParsers(); RegisterSSLParsers(); - RegisterSMBParsers(); - /** \todo bug 719 */ - //RegisterSMB2Parsers(); RegisterDCERPCParsers(); RegisterDCERPCUDPParsers(); + RegisterRustSMBTCPParsers(); RegisterFTPParsers(); RegisterSSHParsers(); RegisterSMTPParsers(); diff --git a/src/app-layer-protos.c b/src/app-layer-protos.c index eb3d22684e..4ad78b73f4 100644 --- a/src/app-layer-protos.c +++ b/src/app-layer-protos.c @@ -60,9 +60,6 @@ const char *AppProtoToString(AppProto alproto) case ALPROTO_SMB: proto_name = "smb"; break; - case ALPROTO_SMB2: - proto_name = "smb2"; - break; case ALPROTO_DCERPC: proto_name = "dcerpc"; break; @@ -135,7 +132,6 @@ AppProto StringToAppProto(const char *proto_name) if (strcmp(proto_name,"msn")==0) return ALPROTO_MSN; if (strcmp(proto_name,"jabber")==0) return ALPROTO_JABBER; if (strcmp(proto_name,"smb")==0) return ALPROTO_SMB; - if (strcmp(proto_name,"smb2")==0) return ALPROTO_SMB2; if (strcmp(proto_name,"dcerpc")==0) return ALPROTO_DCERPC; if (strcmp(proto_name,"irc")==0) return ALPROTO_IRC; if (strcmp(proto_name,"dns")==0) return ALPROTO_DNS; diff --git a/src/app-layer-protos.h b/src/app-layer-protos.h index 0d1d8bff6b..c258935b79 100644 --- a/src/app-layer-protos.h +++ b/src/app-layer-protos.h @@ -36,7 +36,6 @@ enum AppProtoEnum { ALPROTO_MSN, ALPROTO_JABBER, ALPROTO_SMB, - ALPROTO_SMB2, ALPROTO_DCERPC, ALPROTO_IRC, diff --git a/src/app-layer-smb.c b/src/app-layer-smb.c deleted file mode 100644 index 3fb3dc3e7d..0000000000 --- a/src/app-layer-smb.c +++ /dev/null @@ -1,2821 +0,0 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Kirby Kuehl - * - * \brief SMBv1 parser/decoder - */ - -#include "suricata-common.h" - -#include "debug.h" -#include "decode.h" -#include "threads.h" - -#include "util-print.h" -#include "util-pool.h" -#include "util-debug.h" - -#include "stream-tcp-private.h" -#include "stream-tcp-reassemble.h" -#include "stream-tcp.h" -#include "stream.h" - -#include "app-layer.h" -#include "app-layer-detect-proto.h" -#include "app-layer-protos.h" -#include "app-layer-parser.h" -#include "app-layer-dcerpc.h" - -#include "util-spm.h" -#include "util-unittest.h" -#include "util-memcmp.h" - -#ifdef HAVE_RUST -#include "rust.h" -#include "app-layer-smb-tcp-rust.h" -void RegisterSMBParsers(void) -{ - RegisterRustSMBTCPParsers(); -} - -#else // no RUST - -#include "app-layer-smb.h" - -enum { - SMB_FIELD_NONE = 0, - SMB_PARSE_NBSS_HEADER, - SMB_PARSE_SMB_HEADER, - SMB_PARSE_GET_WORDCOUNT, - SMB_PARSE_WORDCOUNT, - SMB_PARSE_GET_BYTECOUNT, - SMB_PARSE_BYTECOUNT, - /* must be last */ - SMB_FIELD_MAX, -}; - -/** - * \brief SMB Write AndX Request Parsing - */ -/* For WriteAndX we need to get writeandxdataoffset */ -static uint32_t SMBParseWriteAndX(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - switch (sstate->andx.andxbytesprocessed) { - case 0: - sstate->andx.paddingparsed = 0; - if (input_len >= 28) { - sstate->andx.andxcommand = *p; - sstate->andx.andxoffset = *(p + 2); - sstate->andx.andxoffset |= *(p + 3) << 8; - sstate->andx.datalengthhigh = *(p + 18); - sstate->andx.datalengthhigh |= *(p + 19) << 8; - sstate->andx.datalength = *(p + 20); - sstate->andx.datalength |= *(p + 21) << 8; - sstate->andx.dataoffset = *(p + 22); - sstate->andx.dataoffset |= *(p + 23) << 8; - sstate->andx.dataoffset |= (uint64_t) *(p + 24) << 56; - sstate->andx.dataoffset |= (uint64_t) *(p + 25) << 48; - sstate->andx.dataoffset |= (uint64_t) *(p + 26) << 40; - sstate->andx.dataoffset |= (uint64_t) *(p + 27) << 32; - sstate->bytesprocessed += 28; - SCReturnUInt(28U); - } else { - sstate->andx.andxcommand = *(p++); - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - p++; // Reserved - if (!(--input_len)) - break; - /* fall through */ - case 2: - sstate->andx.andxoffset = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 3: - sstate->andx.andxoffset |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 4: - // SMB_COM_WRITE_ANDX Fid 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 5: - // SMB_COM_WRITE_ANDX Fid 2 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 6: - // SMB_COM_WRITE_ANDX Offset 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 7: - // SMB_COM_WRITE_ANDX Offset 2 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 8: - // SMB_COM_WRITE_ANDX Offset 3 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 9: - // SMB_COM_WRITE_ANDX Offset 4 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 10: - // SMB_COM_WRITE_ANDX Reserved 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 11: - // SMB_COM_WRITE_ANDX Reserved 2 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 12: - // SMB_COM_WRITE_ANDX Reserved 3 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 13: - // SMB_COM_WRITE_ANDX Reserved 4 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 14: - // SMB_COM_WRITE_ANDX WriteMode 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 15: - // SMB_COM_WRITE_ANDX WriteMode 2 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 16: - // SMB_COM_WRITE_ANDX BytesRemaining 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 17: - // SMB_COM_WRITE_ANDX BytesRemaining 2 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - // DataLengthHigh 1 - sstate->andx.datalengthhigh = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 19: - // DataLengthHigh 2 - sstate->andx.datalengthhigh |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 20: - // DataLength 1 - sstate->andx.datalength = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 21: - // DataLength 2 - sstate->andx.datalength |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 22: - sstate->andx.dataoffset = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 23: - sstate->andx.dataoffset |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 24: - sstate->andx.dataoffset |= (uint64_t) *(p++) << 56; - if (!(--input_len)) - break; - /* fall through */ - case 25: - sstate->andx.dataoffset |= (uint64_t) *(p++) << 48; - if (!(--input_len)) - break; - /* fall through */ - case 26: - sstate->andx.dataoffset |= (uint64_t) *(p++) << 40; - if (!(--input_len)) - break; - /* fall through */ - case 27: - sstate->andx.dataoffset |= (uint64_t) *(p++) << 32; - --input_len; - break; - /* fall through */ - default: - sstate->bytesprocessed++; - SCReturnUInt(1); - break; - } - sstate->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * \brief SMB Read AndX Response Parsing - */ -static uint32_t SMBParseReadAndX(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - switch (sstate->andx.andxbytesprocessed) { - case 0: - sstate->andx.paddingparsed = 0; - if (input_len >= 24) { - sstate->andx.andxcommand = *p; - sstate->andx.andxoffset = *(p + 2); - sstate->andx.andxoffset |= *(p + 3) << 8; - sstate->andx.datalength = *(p + 10); - sstate->andx.datalength |= *(p + 11) << 8; - sstate->andx.dataoffset = *(p + 12); - sstate->andx.dataoffset |= *(p + 13) << 8; - sstate->andx.datalength |= (uint64_t) *(p + 14) << 32; - sstate->andx.datalength |= (uint64_t) *(p + 15) << 40; - sstate->andx.datalength |= (uint64_t) *(p + 16) << 48; - sstate->andx.datalength |= (uint64_t) *(p + 17) << 56; - sstate->bytesprocessed += 24; - SCReturnUInt(24U); - } else { - sstate->andx.andxcommand = *(p++); - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - p++; // Reserved - if (!(--input_len)) - break; - /* fall through */ - case 2: - sstate->andx.andxoffset |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 3: - sstate->andx.andxoffset |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 4: - // SMB_COM_READ_ANDX Remaining Reserved must be 0xff - p++; - if (!(--input_len)) - break; - /* fall through */ - case 5: - // SMB_COM_READ_ANDX Remaining Reserved must be 0xff - p++; - if (!(--input_len)) - break; - /* fall through */ - case 6: - // SMB_COM_READ_ANDX DataCompactionMode 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 7: - // SMB_COM_READ_ANDX DataCompactionMode 1 - p++; - if (!(--input_len)) - break; - /* fall through */ - case 8: - // SMB_COM_READ_ANDX Reserved - p++; - if (!(--input_len)) - break; - /* fall through */ - case 9: - // SMB_COM_READ_ANDX Reserved - p++; - if (!(--input_len)) - break; - /* fall through */ - case 10: - sstate->andx.datalength = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 11: - sstate->andx.datalength |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 12: - sstate->andx.dataoffset = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 13: - sstate->andx.dataoffset |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 14: - sstate->andx.datalength |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 15: - sstate->andx.datalength |= *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 16: - // SMB_COM_READ_ANDX Reserved - p++; - if (!(--input_len)) - break; - /* fall through */ - case 17: - // SMB_COM_READ_ANDX Reserved - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - // SMB_COM_READ_ANDX Reserved - p++; - --input_len; - break; - default: - sstate->bytesprocessed++; - SCReturnUInt(1); - break; - - } - sstate->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t SMBParseTransact(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - switch (sstate->andx.andxbytesprocessed) { - case 0: - sstate->andx.paddingparsed = 0; - if (input_len >= 26) { - sstate->andx.datalength = *(p + 22); - sstate->andx.datalength |= *(p + 23) << 8; - sstate->andx.dataoffset = *(p + 24); - sstate->andx.dataoffset |= *(p + 25) << 8; - sstate->andx.datalength |= (uint64_t) *(p + 14) << 56; - sstate->andx.datalength |= (uint64_t) *(p + 15) << 48; - sstate->andx.datalength |= (uint64_t) *(p + 16) << 40; - sstate->andx.datalength |= (uint64_t) *(p + 17) << 32; - sstate->bytesprocessed += 26; - sstate->andx.andxbytesprocessed += 26; - SCReturnUInt(sstate->wordcount.wordcount); - } else { - /* total parameter count 1 */ - p++; - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - /* total parameter count 2 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 2: - /* total data count 1 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 3: - /* total data count 2 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 4: - /* max parameter count 1 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 5: - /* max parameter count 2 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 6: - /* max data count 1 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 7: - /* max data count 2 */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 8: - /* max setup count */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 9: - /* Reserved */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 10: - /* Flags */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 11: - /* Flags */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 12: - /* Timeout */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 13: - /* Timeout */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 14: - /* Timeout */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 15: - /* Timeout */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 16: - /* Reserved */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 17: - /* Reserved */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 18: - /* Parameter Count */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 19: - /* Parameter Count */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 20: - /* Parameter Offset */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 21: - /* Parameter Offset */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 22: - /* Data Count */ - sstate->andx.datalength = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 23: - /* Data Count */ - sstate->andx.datalength |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 24: - /* Data Offset */ - sstate->andx.dataoffset = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 25: - /* Data Offset */ - sstate->andx.dataoffset |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 26: - /* Setup Count */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 27: - /* Reserved */ - p++; - if (!(--input_len)) - break; - /* fall through */ - case 28: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 29: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 30: - p++; - if (!(--input_len)) - break; - /* fall through */ - case 31: - p++; - --input_len; - break; - default: - SCLogDebug("SMB_COM_TRANSACTION AndX bytes processed is greater than 31 %u", sstate->andx.andxbytesprocessed); - sstate->bytesprocessed++; - sstate->andx.andxbytesprocessed++; - SCReturnUInt(1); - break; - } - sstate->bytesprocessed += (p - input); - sstate->andx.andxbytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * Handle variable length padding for WriteAndX and ReadAndX - */ -static uint32_t PaddingParser(void *smb_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - /* Check for validity of dataoffset */ - if ((uint64_t)(sstate->bytesprocessed - NBSS_HDR_LEN) > sstate->andx.dataoffset) { - sstate->andx.paddingparsed = 1; - SCReturnUInt((uint32_t)(p - input)); - } - while (((uint64_t)(sstate->bytesprocessed - NBSS_HDR_LEN) + (p - input)) - < sstate->andx.dataoffset && sstate->bytecount.bytecountleft-- - && input_len--) { - SCLogDebug("0x%02x ", *p); - p++; - } - if (((uint64_t)(sstate->bytesprocessed - NBSS_HDR_LEN) + (p - input)) - == sstate->andx.dataoffset) { - sstate->andx.paddingparsed = 1; - } - sstate->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * \brief Parse WriteAndX and ReadAndX Data - * \retval -1 f DCERPCParser does not validate - * \retval Number of bytes processed - */ -static int32_t DataParser(void *smb_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - int32_t parsed = 0; - - if (sstate->andx.paddingparsed) { - parsed = DCERPCParser(&sstate->ds.dcerpc, input, input_len); - if (parsed == -1 || parsed > sstate->bytecount.bytecountleft || parsed > (int32_t)input_len) { - SCReturnInt(-1); - } else { - sstate->dcerpc_present = 1; - sstate->bytesprocessed += parsed; - sstate->bytecount.bytecountleft -= parsed; - input_len -= parsed; - (void)input_len; /* for scan-build */ - } - } - SCReturnInt(parsed); -} - -/** - * \brief Obtain SMB WordCount which is 2 times the value. - * Reset bytecount.bytecountbytes to 0. - * Determine if this is an SMB AndX Command - */ -static uint32_t SMBGetWordCount(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - if (input_len > 0) { - SMBState *sstate = (SMBState *) smb_state; - sstate->wordcount.wordcount = *(input) * 2; - sstate->wordcount.wordcountleft = sstate->wordcount.wordcount; - sstate->bytesprocessed++; - sstate->bytecount.bytecountbytes = 0; - sstate->andx.isandx = isAndX(sstate); - SCLogDebug("Wordcount (%u):", sstate->wordcount.wordcount); - SCReturnUInt(1U); - } - - SCReturnUInt(0); -} - -/* - * Obtain SMB Bytecount. Handle the corner obfuscation case where a packet boundary - * is after the first bytecount byte. - */ - -static uint32_t SMBGetByteCount(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - if (input_len && sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN + 1 - + sstate->wordcount.wordcount) { - sstate->bytecount.bytecount = *(p++); - sstate->bytesprocessed++; - --input_len; - } - - if (input_len && sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN + 2 - + sstate->wordcount.wordcount) { - sstate->bytecount.bytecount |= *(p++) << 8; - sstate->bytecount.bytecountleft = sstate->bytecount.bytecount; - sstate->bytesprocessed++; - SCLogDebug("Bytecount %u", sstate->bytecount.bytecount); - --input_len; - } - - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * \brief SMBParseWordCount parses the SMB Wordcount portion of the SMB Transaction. - * until sstate->wordcount.wordcount bytes are parsed. - */ -static uint32_t SMBParseWordCount(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - uint32_t retval = 0; - - if ((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command - == SMB_COM_READ_ANDX) { - retval = SMBParseReadAndX(f, sstate, pstate, input, input_len); - if (retval <= sstate->wordcount.wordcountleft) { - sstate->wordcount.wordcountleft -= retval; - SCLogDebug("SMB_COM_READ_ANDX returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset); - SCReturnUInt(retval); - } else { - SCReturnUInt(0U); - } - - } else if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0) - && sstate->smb.command == SMB_COM_WRITE_ANDX) { - retval = SMBParseWriteAndX(f, sstate, pstate, input, input_len); - if (retval <= sstate->wordcount.wordcountleft) { - sstate->wordcount.wordcountleft -= retval; - SCLogDebug("SMB_COM_WRITE_ANDX returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset); - SCReturnUInt(retval); - } else { - SCReturnUInt(0U); - } - - } else if (sstate->smb.command == SMB_COM_TRANSACTION) { - retval = SMBParseTransact(f, sstate, pstate, input, input_len); - if (retval <= sstate->wordcount.wordcountleft) { - sstate->wordcount.wordcountleft -= retval; - SCLogDebug("SMB_COM_TRANSACTION returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset); - SCReturnUInt(retval); - } else { - SCReturnUInt(0U); - } - - } else { /* Generic WordCount Handler */ - while (sstate->wordcount.wordcountleft-- && input_len--) { - SCLogDebug("0x%02x wordcount %u/%u input_len %u", *p, - sstate->wordcount.wordcountleft, - sstate->wordcount.wordcount, input_len); - p++; - } - sstate->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); - } -} - -/** - * \brief SMBParseByteCount parses the SMB ByteCount portion of the SMB Transaction. - * until sstate->bytecount.bytecount bytes are parsed. - */ -static uint32_t SMBParseByteCount(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - uint32_t ures = 0; /* unsigned */ - int32_t sres = 0; /* signed */ - uint32_t parsed = 0; - - if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && - sstate->smb.command == SMB_COM_READ_ANDX) || - (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0) - && sstate->smb.command == SMB_COM_WRITE_ANDX) || - (sstate->smb.command == SMB_COM_TRANSACTION)) - { - if (sstate->andx.paddingparsed == 0) { - ures = PaddingParser(sstate, pstate, input + parsed, input_len); - if (ures <= input_len) { - parsed += ures; - input_len -= ures; - } else { - SCReturnUInt(0U); - } - } - - if (sstate->andx.datalength && input_len) { - /* Uncomment the next line to help debug DCERPC over SMB */ - //hexdump(f, input + parsed, input_len); - sres = DataParser(sstate, pstate, input + parsed, input_len); - if (sres != -1 && sres <= (int32_t)input_len) { - parsed += (uint32_t)sres; - (void)parsed; /* for scan-build */ - input_len -= (uint32_t)sres; - (void)input_len; /* for scan-build */ - } else { /* Did not Validate as DCERPC over SMB */ - while (sstate->bytecount.bytecountleft-- && input_len--) { - SCLogDebug("0x%02x bytecount %"PRIu16"/%"PRIu16" input_len %"PRIu32, *p, - sstate->bytecount.bytecountleft, - sstate->bytecount.bytecount, input_len); - p++; - } - sstate->bytesprocessed += (p - input); - SCReturnUInt((p - input)); - } - } - SCReturnUInt(ures); - } - - while (sstate->bytecount.bytecountleft-- && input_len--) { - SCLogDebug("0x%02x bytecount %u/%u input_len %u", *p, - sstate->bytecount.bytecountleft, - sstate->bytecount.bytecount, input_len); - p++; - } - sstate->bytesprocessed += (p - input); - - SCReturnUInt((p - input)); -} - -/** - * \brief Parse a NBSS header. - * - * \retval 4 parsing of the header is done - * \retval 3 parsing partially done - * \retval 2 parsing partially done - * \retval 1 parsing partially done - * \retval 0 no input or already done - */ -static uint32_t NBSSParseHeader(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - if (input_len > 0 && sstate->bytesprocessed < (NBSS_HDR_LEN - 1)) { - switch (sstate->bytesprocessed) { - case 0: - /* Initialize */ - sstate->andx.andxcommand = SMB_NO_SECONDARY_ANDX_COMMAND; - sstate->andx.maxchainedandx = 5; - - /* fast track for having all bytes (common case) */ - if (input_len >= NBSS_HDR_LEN) { - sstate->nbss.type = *p; - sstate->nbss.length = (*(p + 1) & 0x01) << 16; - sstate->nbss.length |= *(p + 2) << 8; - sstate->nbss.length |= *(p + 3); - sstate->bytesprocessed += NBSS_HDR_LEN; - SCReturnUInt(4U); - } else { - sstate->nbss.type = *(p++); - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - sstate->nbss.length = (*(p++) & 0x01) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 2: - sstate->nbss.length |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 3: - sstate->nbss.length |= *(p++); - --input_len; - break; - } - sstate->bytesprocessed += (p - input); - } - - SCReturnUInt((uint32_t)(p - input)); -} - -/** - * \brief parse and validate the 32 byte SMB Header - * - * \retval 32 parsing done - * \retval >0<32 parsing in progress - * \retval 0 no input or already fully parsed - * \retval -1 error - */ -static int SMBParseHeader(Flow *f, void *smb_state, - AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint8_t *p = input; - - if (input_len > 0) { - switch (sstate->bytesprocessed) { - case 4: - // fallthrough - /* above statement to prevent coverity FPs from the switch - * fall through */ - if (input_len >= SMB_HDR_LEN) { - if (SCMemcmp(p, "\xff\x53\x4d\x42", 4) != 0) { - SCLogDebug("SMB Header did not validate"); - SCReturnInt(-1); - } - sstate->smb.command = *(p + 4); - sstate->smb.status = (uint32_t) *(p + 5) << 24; - sstate->smb.status |= (uint32_t) *(p + 6) << 16; - sstate->smb.status |= (uint32_t) *(p + 7) << 8; - sstate->smb.status |= (uint32_t) *(p + 8); - sstate->smb.flags = *(p + 9); - sstate->smb.flags2 = *(p + 10) << 8; - sstate->smb.flags2 |= *(p + 11); - sstate->smb.pidhigh = *(p + 12) << 8; - sstate->smb.pidhigh |= *(p + 13); - sstate->smb.securitysignature = (uint64_t) *(p + 14) << 56; - sstate->smb.securitysignature |= (uint64_t) *(p + 15) << 48; - sstate->smb.securitysignature |= (uint64_t) *(p + 16) << 40; - sstate->smb.securitysignature |= (uint64_t) *(p + 17) << 32; - sstate->smb.securitysignature |= (uint64_t) *(p + 18) << 24; - sstate->smb.securitysignature |= (uint64_t) *(p + 19) << 16; - sstate->smb.securitysignature |= (uint64_t) *(p + 20) << 8; - sstate->smb.securitysignature |= (uint64_t) *(p + 21); - sstate->smb.tid = *(p + 24) << 8; - sstate->smb.tid |= *(p + 25); - sstate->smb.pid = *(p + 26) << 8; - sstate->smb.pid |= *(p + 27); - sstate->smb.uid = *(p + 28) << 8; - sstate->smb.uid |= *(p + 29); - sstate->smb.mid = *(p + 30) << 8; - sstate->smb.mid |= *(p + 31); - sstate->bytesprocessed += SMB_HDR_LEN; - SCReturnInt(32); - break; - } else { - if (*(p++) != 0xff) { - SCLogDebug("SMB Header did not validate"); - SCReturnInt(-1); - } - if (!(--input_len)) - break; - /* We fall through to the next case if we still have input. - * Same applies for other cases as well */ - } - /* fall through */ - case 5: - if (*(p++) != 'S') { - SCLogDebug("SMB Header did not validate"); - SCReturnInt(-1); - } - if (!(--input_len)) - break; - /* fall through */ - case 6: - if (*(p++) != 'M') { - SCLogDebug("SMB Header did not validate"); - SCReturnInt(-1); - } - if (!(--input_len)) - break; - /* fall through */ - case 7: - if (*(p++) != 'B') { - SCLogDebug("SMB Header did not validate"); - SCReturnInt(-1); - } - if (!(--input_len)) - break; - /* fall through */ - case 8: - sstate->smb.command = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 9: - sstate->smb.status = *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 10: - sstate->smb.status |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 11: - sstate->smb.status |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 12: - sstate->smb.status |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 13: - sstate->smb.flags = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 14: - sstate->smb.flags2 = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 15: - sstate->smb.flags2 |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 16: - sstate->smb.pidhigh = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 17: - sstate->smb.pidhigh |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 18: - sstate->smb.securitysignature = (uint64_t) *(p++) << 56; - if (!(--input_len)) - break; - /* fall through */ - case 19: - sstate->smb.securitysignature |= (uint64_t) *(p++) << 48; - if (!(--input_len)) - break; - /* fall through */ - case 20: - sstate->smb.securitysignature |= (uint64_t) *(p++) << 40; - if (!(--input_len)) - break; - /* fall through */ - case 21: - sstate->smb.securitysignature |= (uint64_t) *(p++) << 32; - if (!(--input_len)) - break; - /* fall through */ - case 22: - sstate->smb.securitysignature |= (uint64_t) *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 23: - sstate->smb.securitysignature |= (uint64_t) *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 24: - sstate->smb.securitysignature |= (uint64_t) *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 25: - sstate->smb.securitysignature |= (uint64_t) *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 26: - p++; // UNUSED - if (!(--input_len)) - break; - /* fall through */ - case 27: - p++; // UNUSED - if (!(--input_len)) - break; - /* fall through */ - case 28: - sstate->smb.tid = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 29: - sstate->smb.tid |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 30: - sstate->smb.pid = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 31: - sstate->smb.pid |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 32: - sstate->smb.uid = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 33: - sstate->smb.uid |= *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 34: - sstate->smb.mid = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 35: - sstate->smb.mid |= *(p++); - --input_len; - break; - /* fall through */ - } - } - sstate->bytesprocessed += (p - input); - - SCReturnInt((p - input)); -} - -static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len, - void *local_data, uint8_t dir) -{ - SCEnter(); - - SMBState *sstate = (SMBState *) smb_state; - uint64_t retval = 0; - uint64_t parsed = 0; - int hdrretval = 0; - int counter = 0; - - if (pstate == NULL) { - SCLogDebug("pstate == NULL"); - SCReturnInt(0); - } - - if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { - SCReturnInt(1); - } else if (input == NULL) { - SCReturnInt(-1); - } - - if (sstate->bytesprocessed != 0 && sstate->data_needed_for_dir != dir) { - SCReturnInt(-1); - } - - while (input_len) { - /* till we clear corner cases */ - if (counter++ == 30) { - SCLogDebug("Somehow seem to be stuck inside the smb " - "parser for quite sometime. Let's get out of here."); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } - - while (input_len && sstate->bytesprocessed < NBSS_HDR_LEN) { - retval = NBSSParseHeader(f, smb_state, pstate, input + parsed, - input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - SCLogDebug("[1] NBSS Header (%u/%u) Type 0x%02x Length 0x%04x " - "parsed %"PRIu64" input_len %u", - sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type, - sstate->nbss.length, parsed, input_len); - } else if (input_len) { - SCLogDebug("Error parsing NBSS Header"); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } - } - - switch (sstate->nbss.type) { - case NBSS_SESSION_MESSAGE: - while (input_len && - (sstate->bytesprocessed >= NBSS_HDR_LEN && - sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN)) { - /* inside while */ - hdrretval = SMBParseHeader(f, smb_state, pstate, input + parsed, - input_len); - if (hdrretval == -1 || hdrretval > (int32_t)input_len) { - SCLogDebug("Error parsing SMB Header"); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } else { - parsed += hdrretval; - input_len -= hdrretval; - SCLogDebug("[2] SMB Header (%u/%u) Command 0x%02x " - "parsed %"PRIu64" input_len %u", - sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN, - sstate->smb.command, parsed, input_len); - } - } /* while */ - - do { - if (input_len && - (sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN)) { - /* inside if */ - retval = SMBGetWordCount(f, smb_state, pstate, input + parsed, - input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing SMB Word Count"); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } - SCLogDebug("[3] WordCount (%u/%u) WordCount %u parsed " - "%"PRIu64" input_len %u", - sstate->bytesprocessed, - NBSS_HDR_LEN + SMB_HDR_LEN + 1, - sstate->wordcount.wordcount, - parsed, input_len); - } /* if (input_len && ..) */ - - while (input_len && - (sstate->bytesprocessed >= NBSS_HDR_LEN + SMB_HDR_LEN + 1 && - sstate->bytesprocessed < (NBSS_HDR_LEN + SMB_HDR_LEN + 1 + - sstate->wordcount.wordcount))) { - /* inside while */ - retval = SMBParseWordCount(f, smb_state, pstate, - input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing SMB Word Count Data retval " - "%"PRIu64" input_len %u", retval, input_len); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } - SCLogDebug("[4] Parsing WordCount (%u/%u) WordCount %u " - "parsed %"PRIu64" input_len %u", - sstate->bytesprocessed, - NBSS_HDR_LEN + SMB_HDR_LEN + 1 + - sstate->wordcount.wordcount, - sstate->wordcount.wordcount, - parsed, input_len); - } /* while (input_len && ..) */ - - while (input_len && - (sstate->bytesprocessed >= (NBSS_HDR_LEN + SMB_HDR_LEN + - 1 + sstate->wordcount.wordcount) && - sstate->bytesprocessed < (NBSS_HDR_LEN + SMB_HDR_LEN + 3 - + sstate->wordcount.wordcount))) { - /* inside while */ - retval = SMBGetByteCount(f, smb_state, pstate, input + parsed, - input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing SMB Byte Count"); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } - SCLogDebug("[5] ByteCount (%u/%u) ByteCount %u parsed " - "%"PRIu64" input_len %u", - sstate->bytesprocessed, - NBSS_HDR_LEN + SMB_HDR_LEN + 3, - sstate->bytecount.bytecount, - parsed, input_len); - - if (sstate->bytecount.bytecount == 0) { - sstate->bytesprocessed = 0; - input_len = 0; - } - } /* while (input_len && ..) */ - - while (input_len && - (sstate->bytesprocessed >= (NBSS_HDR_LEN + SMB_HDR_LEN + - 3 + sstate->wordcount.wordcount)) && - (sstate->bytesprocessed < (NBSS_HDR_LEN + SMB_HDR_LEN + 3 - + sstate->wordcount.wordcount - + sstate->bytecount.bytecount))) { - /* inside while */ - retval = SMBParseByteCount(f, smb_state, pstate, - input + parsed, input_len); - if (retval && retval <= input_len) { - parsed += retval; - input_len -= retval; - } else if (input_len) { - SCLogDebug("Error parsing SMB Byte Count Data"); - sstate->bytesprocessed = 0; - SCReturnInt(0); - } - SCLogDebug("[6] Parsing ByteCount (%u/%u) ByteCount %u " - "parsed %"PRIu64" input_len %u", - sstate->bytesprocessed, - NBSS_HDR_LEN + SMB_HDR_LEN + 1 + - sstate->wordcount.wordcount + 2 + - sstate->bytecount.bytecount, - sstate->bytecount.bytecount, parsed, input_len); - } /* while (input_len && ..) */ - - } while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND && - input_len && sstate->andx.maxchainedandx--); - - if (sstate->bytesprocessed >= sstate->nbss.length + NBSS_HDR_LEN || - sstate->andx.maxchainedandx == 0) { - /* inside if */ - sstate->bytesprocessed = 0; - sstate->transaction_id++; - input_len = 0; - } - break; - - case NBSS_SESSION_REQUEST: - case NBSS_POSITIVE_SESSION_RESPONSE: - case NBSS_NEGATIVE_SESSION_RESPONSE: - case NBSS_RETARGET_SESSION_RESPONSE: - case NBSS_SESSION_KEEP_ALIVE: - if (sstate->bytesprocessed < (sstate->nbss.length + NBSS_HDR_LEN)) { - if (input_len >= (sstate->nbss.length + NBSS_HDR_LEN - - sstate->bytesprocessed)) { - /* inside if */ - input_len -= (sstate->nbss.length + NBSS_HDR_LEN - - sstate->bytesprocessed); - parsed += (sstate->nbss.length + NBSS_HDR_LEN - - sstate->bytesprocessed); - sstate->bytesprocessed = 0; - } else { - sstate->bytesprocessed += input_len; - input_len = 0; - } - } else { - sstate->bytesprocessed = 0; - } - break; - - default: - sstate->bytesprocessed = 0; - break; - } /* switch */ - - } /* while (input_len) */ - - sstate->data_needed_for_dir = dir; - SCReturnInt(1); -} - -static int SMBParseRequest(Flow *f, void *smb_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len, - void *local_data, const uint8_t flags) -{ - return SMBParse(f, smb_state, pstate, input, input_len, local_data, 0); -} - -static int SMBParseResponse(Flow *f, void *smb_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len, - void *local_data, const uint8_t flags) -{ - return SMBParse(f, smb_state, pstate, input, input_len, local_data, 1); -} - - -/** - * \brief determines if the SMB command is an ANDX command - * \retval 1 if smb command is an AndX command - * \retval 0 if smb command is not an AndX command - */ - -int isAndX(SMBState *smb_state) -{ - SCEnter(); - - switch (smb_state->smb.command) { - case SMB_NO_SECONDARY_ANDX_COMMAND: - case SMB_COM_LOCKING_ANDX: - case SMB_COM_OPEN_ANDX: - case SMB_COM_READ_ANDX: - case SMB_COM_WRITE_ANDX: - case SMB_COM_SESSION_SETUP_ANDX: - case SMB_COM_LOGOFF_ANDX: - case SMB_COM_TREE_CONNECT_ANDX: - case SMB_COM_NT_CREATE_ANDX: - smb_state->andx.andxbytesprocessed = 0; - SCReturnInt(1); - default: - SCReturnInt(0); - } -} - -/** \internal - * \brief Allocate a SMBState - * \retval s State, or NULL in case of error - */ -static void *SMBStateAlloc(void) -{ - SCEnter(); - - SMBState *s = (SMBState *)SCCalloc(1, sizeof(SMBState)); - if (unlikely(s == NULL)) { - SCReturnPtr(NULL, "void"); - } - - DCERPCInit(&s->ds.dcerpc); - - SCReturnPtr(s, "void"); -} - -/** \internal - * \brief Free a SMBState - */ -static void SMBStateFree(void *s) -{ - SCEnter(); - SMBState *sstate = (SMBState *) s; - - DCERPCCleanup(&sstate->ds.dcerpc); - - if (sstate->ds.de_state) { - DetectEngineStateFree(sstate->ds.de_state); - } - - SCFree(s); - SCReturn; -} - -static int SMBSetTxDetectState(void *vtx, DetectEngineState *de_state) -{ - SMBState *smb_state = (SMBState *)vtx; - smb_state->ds.de_state = de_state; - return 0; -} - -static DetectEngineState *SMBGetTxDetectState(void *vtx) -{ - SMBState *smb_state = (SMBState *)vtx; - return smb_state->ds.de_state; -} - -static void SMBStateTransactionFree(void *state, uint64_t tx_id) -{ - /* do nothing */ -} - -static void *SMBGetTx(void *state, uint64_t tx_id) -{ - SMBState *smb_state = (SMBState *)state; - return smb_state; -} - -static uint64_t SMBGetTxCnt(void *state) -{ - /* single tx */ - return 1; -} - -static int SMBGetAlstateProgressCompletionStatus(uint8_t direction) -{ - return 1; -} - -static int SMBGetAlstateProgress(void *tx, uint8_t direction) -{ - return 0; -} - -#define SMB_PROBING_PARSER_MIN_DEPTH 8 - -static uint16_t SMBProbingParser(Flow *f, uint8_t direction, - uint8_t *input, uint32_t ilen, uint8_t *rdir) -{ - int32_t len; - int32_t input_len = ilen; - - while (input_len >= SMB_PROBING_PARSER_MIN_DEPTH) { - switch (input[0]) { - case NBSS_SESSION_MESSAGE: - if (input[4] == 0xFF && input[5] == 'S' && input[6] == 'M' && - input[7] == 'B') { - return ALPROTO_SMB; - } - - /* fall through */ - case NBSS_SESSION_REQUEST: - case NBSS_POSITIVE_SESSION_RESPONSE: - case NBSS_NEGATIVE_SESSION_RESPONSE: - case NBSS_RETARGET_SESSION_RESPONSE: - case NBSS_SESSION_KEEP_ALIVE: - len = (input[1] & 0x01) << 16; - len |= input[2] << 8; - len |= input[3]; - break; - default: - /* -1 indicates a stream where the probing parser would be - * unable to find nbss, even if it exists. This should - * prevent the probing parser from beig invoked henceforth */ - return ALPROTO_FAILED; - } - - input_len -= 4; - if (len >= input_len) { - return ALPROTO_UNKNOWN; - } - - input_len -= len; - input += 4 + len; - } - - return ALPROTO_UNKNOWN; -} - -static int SMBRegisterPatternsForProtocolDetection(void) -{ - int r = 0; - r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, - "|ff|SMB", 8, 4, STREAM_TOSERVER); - r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, - "|ff|SMB", 8, 4, STREAM_TOCLIENT); - - r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, - "|fe|SMB", 8, 4, STREAM_TOSERVER); - r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, - "|fe|SMB", 8, 4, STREAM_TOCLIENT); - return r == 0 ? 0 : -1; -} - -void RegisterSMBParsers(void) -{ - const char *proto_name = "smb"; - - if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { - AppLayerProtoDetectRegisterProtocol(ALPROTO_SMB, proto_name); - if (SMBRegisterPatternsForProtocolDetection() < 0) - return; - - if (RunmodeIsUnittests()) { - AppLayerProtoDetectPPRegister(IPPROTO_TCP, - "139", - ALPROTO_SMB, - SMB_PROBING_PARSER_MIN_DEPTH, 0, - STREAM_TOSERVER, - SMBProbingParser, SMBProbingParser); - } else { - AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, - proto_name, ALPROTO_SMB, - SMB_PROBING_PARSER_MIN_DEPTH, 0, - SMBProbingParser, SMBProbingParser); - } - - AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOSERVER); - } else { - SCLogInfo("Protocol detection and parser disabled for %s protocol.", - proto_name); - return; - } - - if (AppLayerParserConfParserEnabled("tcp", proto_name)) { - AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOSERVER, SMBParseRequest); - AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOCLIENT, SMBParseResponse); - AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SMB, SMBStateAlloc, SMBStateFree); - - AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_SMB, SMBStateTransactionFree); - - AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_SMB, - SMBGetTxDetectState, SMBSetTxDetectState); - - AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMB, SMBGetTx); - - AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_SMB, SMBGetTxCnt); - - AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_SMB, SMBGetAlstateProgress); - - AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_SMB, - SMBGetAlstateProgressCompletionStatus); - } else { - SCLogInfo("Parsed disabled for %s protocol. Protocol detection " - "still on.", proto_name); - } - -#ifdef UNITTESTS - AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB, SMBParserRegisterTests); -#endif - return; -} - -/* UNITTESTS */ -#ifdef UNITTESTS -#include "flow-util.h" - -/** - * \test SMBParserTest01 tests the NBSS and SMB header decoding - */ -static int SMBParserTest01(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf[] = "\x00\x00\x00\x85" // NBSS - "\xff\x53\x4d\x42\x72\x00\x00\x00" // SMB - "\x00\x18\x53\xc8\x00\x00\x00\x00" - "\x00\x00\x00\x00\x00\x00\x00\x00" - "\x00\x00\xff\xfe\x00\x00\x00\x00" - "\x00" // WordCount - "\x62\x00" // ByteCount - "\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20" - "\x31\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00\x02\x57\x69\x6e\x64\x6f\x77\x73" - "\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61\x00\x02\x4c" - "\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54" - "\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00"; - - uint32_t smblen = sizeof(smbbuf) - 1; - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOSERVER | STREAM_EOF, smbbuf, smblen); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->nbss.type != NBSS_SESSION_MESSAGE) { - printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb_state->nbss.type); - goto end; - } - - if (smb_state->nbss.length != 133) { - printf("expected nbss length 0x%02x , got 0x%02x : ", 133, smb_state->nbss.length); - goto end; - } - - if (smb_state->smb.command != SMB_COM_NEGOTIATE) { - printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_NEGOTIATE, smb_state->smb.command); - goto end; - } - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test SMBParserTest02 tests the NBSS, SMB, and DCERPC over SMB header decoding - */ -static int SMBParserTest02(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf[] = { - 0x00, 0x00, 0x00, 0x92, 0xff, 0x53, 0x4d, 0x42, - 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x64, 0x05, - 0x00, 0x08, 0x00, 0x00, 0x10, 0x00, 0x00, 0x48, - 0x00, 0x00, 0x04, 0xe0, 0xff, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x4a, 0x00, 0x48, 0x00, 0x4a, 0x00, 0x02, - 0x00, 0x26, 0x00, 0x00, 0x40, 0x4f, 0x00, 0x5c, - 0x50, 0x49, 0x50, 0x45, 0x5c, 0x00, 0x05, 0x00, - 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, - 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0xfd, - 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, 0xa8, 0x93, - 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x00, 0x00, - 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, - 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, - 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; - - uint32_t smblen = sizeof(smbbuf); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOSERVER | STREAM_EOF, smbbuf, smblen); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->nbss.type != NBSS_SESSION_MESSAGE) { - printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb_state->nbss.type); - goto end; - } - - if (smb_state->nbss.length != 146) { - printf("expected nbss length 0x%02x , got 0x%02x : ", 146, smb_state->nbss.length); - goto end; - } - - if (smb_state->smb.command != SMB_COM_TRANSACTION) { - printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_TRANSACTION, smb_state->smb.command); - goto end; - } - - printUUID("BIND", smb_state->ds.dcerpc.dcerpcbindbindack.uuid_entry); - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest03(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf1[] = { - 0x00, 0x00, 0x07, 0x57, 0xff, 0x53, 0x4d, 0x42, - 0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7f, 0x13, - 0x01, 0x08, 0xc9, 0x29, 0x0e, 0xff, 0x00, 0x00, - 0x00, 0x00, 0x40, 0x55, 0x01, 0x00, 0x00, 0xff, - 0xff, 0xff, 0xff, 0x08, 0x00, 0x0e, 0x00, 0x00, - 0x00, 0x0e, 0x00, 0x49, 0x07, 0x00, 0x00, 0x00, - 0x00, 0x18, 0x07, 0xcc, 0x1b, 0x19, 0xb8, 0x75, - 0x2c, 0x85, 0x52, 0x39, 0x72, 0xfa, 0x9c, 0x5f, - 0x5a, 0xb7, 0x59, 0xa1, 0x83, 0xba, 0x87, 0xd3, - 0xc3, 0xbf, 0xf4, 0x5d, 0x08, 0x32, 0x22, 0x33, - 0x2e, 0x62, 0x46, 0x4d, 0x03, 0x48, 0x1f, 0xea, - 0x7c, 0x65, 0x3e, 0x71, 0xf8, 0xea, 0x20, 0x85, - 0x29, 0x6f, 0x3c, 0xf2, 0x19, 0xb5, 0x65, 0xb0, - 0xce, 0x06, 0xcc, 0x90, 0x86, 0x20, 0x77, 0xf5, - 0xa0, 0xbc, 0x45, 0x9d, 0x4e, 0x92, 0xb4, 0x24, - 0xc8, 0x58, 0x4a, 0xc3, 0x4e, 0xb8, 0x95, 0x8d, - 0x93, 0x0c, 0xce, 0xe0, 0xf9, 0x7d, 0x7e, 0xd3, - 0x46, 0x53, 0x32, 0x95, 0x7d, 0x22, 0x76, 0x0e, - 0x95, 0x23, 0x2e, 0xa6, 0x58, 0x1a, 0xb6, 0x74, - 0x54, 0x4f, 0x37, 0x5c, 0x60, 0x00, 0xb4, 0x55, - 0x5b, 0xda, 0xea, 0x2c, 0xf3, 0x9b, 0x91, 0x6f, - 0xa8, 0x20, 0xd3, 0x40, 0x0c, 0x7c, 0xc7, 0x85, - 0x8c, 0x44, 0x76, 0xbc, 0x22, 0x9d, 0xfd, 0x8e, - 0x21, 0x46, 0x05, 0x41, 0x73, 0x0c, 0x88, 0x62, - 0xdc, 0x62, 0xc1, 0xc8, 0x14, 0xbb, 0x96, 0x60, - 0x77, 0x6c, 0x5c, 0x31, 0x2a, 0xaa, 0x87, 0x69, - 0x99, 0xaa, 0x83, 0x5e, 0x71, 0x11, 0x2a, 0x85, - 0xca, 0x5d, 0xe1, 0x67, 0x4f, 0xa2, 0x3e, 0x4e, - 0x94, 0xe7, 0xa3, 0xe6, 0xa0, 0xdb, 0xc2, 0x05, - 0x01, 0x4f, 0xf5, 0xe9, 0xfc, 0xa2, 0x2a, 0x1c, - 0x63, 0x21, 0xd5, 0x27, 0x98, 0x86, 0x9c, 0x66, - 0x5e, 0xf1, 0x97, 0xb0, 0x86, 0x58, 0x5b, 0x94, - 0x51, 0xfd, 0xb9, 0x83, 0x4c, 0xc4, 0x0f, 0x5f, - 0xdd, 0xc8, 0xce, 0x43, 0xed, 0xe8, 0xae, 0xbc, - 0x52, 0x73, 0xf6, 0x0f, 0x0d, 0xb4, 0xd6, 0xa7, - 0xcf, 0xef, 0x0e, 0x72, 0x34, 0xff, 0x2b, 0x50, - 0x71, 0x2a, 0x98, 0xf0, 0x60, 0x58, 0xde, 0x1d, - 0x96, 0x50, 0xd8, 0xec, 0xeb, 0x40, 0xcb, 0x4c, - 0x3b, 0x2c, 0xee, 0x76, 0xd6, 0x97, 0x1c, 0x69, - 0x61, 0x89, 0xc1, 0x9b, 0x03, 0xda, 0x08, 0x0b, - 0x15, 0xba, 0xd3, 0x3d, 0x8c, 0xea, 0xf7, 0x17, - 0xc3, 0x77, 0xf8, 0x04, 0xca, 0x72, 0xed, 0xfe, - 0xd0, 0x02, 0x73, 0x1b, 0x71, 0x72, 0x17, 0x9f, - 0x14, 0x96, 0xe2, 0x5f, 0xae, 0x5b, 0x7d, 0x7f, - 0xc9, 0x72, 0x9f, 0xd5, 0x32, 0xf4, 0xf3, 0x39, - 0x89, 0x36, 0x00, 0x44, 0xa9, 0x18, 0x21, 0x4b, - 0x26, 0xf2, 0x5a, 0x2a, 0x80, 0xea, 0x6b, 0x3e, - 0x68, 0x27, 0xd0, 0xa0, 0x84, 0x81, 0xb5, 0xa6, - 0x3b, 0xd5, 0xdc, 0xdd, 0xd1, 0xd4, 0x5b, 0xad, - 0x80, 0x91, 0xf2, 0x30, 0x5e, 0x90, 0x17, 0x35, - 0x59, 0xad, 0x34, 0x65, 0x54, 0x04, 0x5a, 0x3c, - 0xe4, 0x68, 0xa7, 0x30, 0x06, 0x7a, 0x85, 0xe7, - 0xf4, 0x20, 0xe3, 0xd7, 0xa5, 0x8b, 0x60, 0xfe, - 0x51, 0xad, 0xda, 0xe2, 0xd1, 0x4f, 0xfb, 0x94, - 0xc9, 0xba, 0xa4, 0x09, 0x5c, 0xde, 0x78, 0xdc, - 0x78, 0x36, 0x96, 0x8b, 0xd6, 0x72, 0xc4, 0xa7, - 0x1c, 0xde, 0x45, 0x85, 0xdf, 0x84, 0xb1, 0x3f, - 0x2b, 0x3f, 0xfe, 0x56, 0x80, 0x8d, 0x26, 0x4a, - 0x39, 0x22, 0x1f, 0x10, 0x89, 0x2e, 0x4e, 0x87, - 0xf5, 0x9c, 0x0e, 0xd9, 0xdd, 0xb2, 0xc9, 0x9c, - 0x3f, 0xc5, 0xe3, 0xab, 0xdc, 0x85, 0x1c, 0xf9, - 0xda, 0xbb, 0x36, 0x9b, 0xe7, 0x21, 0x58, 0x44, - 0xee, 0xb3, 0xe7, 0x37, 0xd3, 0xc3, 0x76, 0x09, - 0x79, 0xe2, 0xf4, 0xf1, 0x27, 0x6b, 0x74, 0xc4, - 0x5f, 0x06, 0x76, 0x78, 0x56, 0xb9, 0x80, 0x7f, - 0x63, 0x53, 0xa2, 0xd1, 0xfc, 0xfb, 0x69, 0x38, - 0x0c, 0x13, 0x6e, 0x9e, 0xea, 0x79, 0xc9, 0x6d, - 0x45, 0x6b, 0xa3, 0xa8, 0x20, 0x21, 0x24, 0xff, - 0x0d, 0x8d, 0xd9, 0x0a, 0x9e, 0xf4, 0x3f, 0xf5, - 0x18, 0x39, 0xdd, 0x9f, 0xed, 0xd6, 0x2b, 0xb1, - 0x4b, 0x3f, 0x24, 0x7e, 0x11, 0x79, 0x37, 0x01, - 0x10, 0xe7, 0x34, 0x1d, 0x36, 0x5f, 0x26, 0x99, - 0x5a, 0x4d, 0xe9, 0x1a, 0x89, 0x24, 0xf8, 0xea, - 0xca, 0x16, 0x19, 0x6c, 0x3b, 0x8e, 0x44, 0x70, - 0x20, 0x5f, 0x46, 0x3c, 0x60, 0xbe, 0x03, 0xfc, - 0x99, 0x29, 0xd7, 0x30, 0x5e, 0xbe, 0x5b, 0x17, - 0x4f, 0xfe, 0x3f, 0xe0, 0x50, 0xa0, 0x1b, 0x1a, - 0x6b, 0x17, 0xf3, 0xf9, 0x01, 0xe8, 0xc6, 0xc8, - 0x0f, 0x81, 0xbd, 0x2d, 0xc5, 0x8c, 0xa1, 0xab, - 0x9d, 0x13, 0xce, 0x73, 0x14, 0x56, 0x56, 0xb4, - 0x68, 0xac, 0x35, 0xf8, 0x6a, 0x55, 0x3e, 0x50, - 0x34, 0x5a, 0x66, 0x17, 0x98, 0x4d, 0xd1, 0xa7, - 0xdf, 0x57, 0xd6, 0xd4, 0x44, 0x64, 0xa7, 0x74, - 0x18, 0x0a, 0x4f, 0xa9, 0xe4, 0xb4, 0x0f, 0x89, - 0xa2, 0xc5, 0xb8, 0xa7, 0x20, 0xa2, 0xb1, 0xf8, - 0x70, 0xaf, 0xee, 0x6e, 0x62, 0xa5, 0x89, 0x5d, - 0xc9, 0x8a, 0xb9, 0x87, 0xac, 0x4d, 0x4d, 0x81, - 0x1c, 0x62, 0xd3, 0xbf, 0x83, 0x79, 0x98, 0x81, - 0xbd, 0xcc, 0x1f, 0x76, 0xc8, 0x7e, 0x2c, 0xec, - 0xdb, 0xa7, 0xa5, 0xea, 0x05, 0x94, 0x3f, 0xef, - 0x66, 0x1c, 0x5d, 0xc4, 0xbd, 0x73, 0x53, 0x1f, - 0xf3, 0xac, 0x1f, 0xa4, 0xb9, 0x78, 0x1b, 0x93, - 0xcb, 0x17, 0xb6, 0xda, 0xbb, 0x45, 0x21, 0xfa, - 0x52, 0xc7, 0x71, 0x05, 0xb3, 0xeb, 0x82, 0x09, - 0x99, 0x90, 0x5d, 0xa9, 0x76, 0xd1, 0x63, 0x6a, - 0x14, 0x99, 0xe9, 0xa5, 0x98, 0x5d, 0xe0, 0xb5, - 0x2a, 0xd1, 0xf1, 0x2e, 0xe7, 0x85, 0xdb, 0x42, - 0xfc, 0x61, 0x09, 0x14, 0xe5, 0x8e, 0x92, 0x70, - 0x91, 0x15, 0x74, 0x2c, 0x16, 0x30, 0xc4, 0xb0, - 0xf1, 0x61, 0xd5, 0x55, 0xa8, 0xa3, 0xca, 0x88, - 0xe6, 0xb1, 0x58, 0x76, 0xa5, 0x4c, 0x48, 0xe3, - 0xdd, 0x7a, 0x5e, 0x0a, 0x86, 0xfd, 0xd6, 0xe8, - 0xc0, 0x47, 0x27, 0x1a, 0x58, 0x92, 0xad, 0xa6, - 0x51, 0x32, 0x4d, 0x0d, 0x29, 0xd3, 0xcf, 0xf1, - 0xcc, 0x29, 0x1a, 0xfe, 0xf6, 0xa0, 0xf3, 0xdd, - 0x98, 0x73, 0xcb, 0xbb, 0x8a, 0xe9, 0x55, 0xba, - 0x89, 0x2d, 0x31, 0x9b, 0x3d, 0x04, 0x1f, 0xb5, - 0x1c, 0x84, 0x63, 0xca, 0xde, 0x75, 0xac, 0x91, - 0x78, 0x1f, 0x8b, 0x37, 0x8d, 0x46, 0xaa, 0x79, - 0x51, 0xbf, 0x30, 0xfa, 0x3d, 0x9b, 0xd9, 0x20, - 0x25, 0x18, 0x46, 0xb6, 0xe7, 0x8e, 0xf7, 0x5e, - 0x7d, 0xf8, 0xd3, 0x01, 0x39, 0xe5, 0x9d, 0x46, - 0x6b, 0x8c, 0xcf, 0x9d, 0xc6, 0xb9, 0xe8, 0xd8, - 0x25, 0x2d, 0x96, 0x07, 0xc7, 0x4e, 0xa3, 0x3a, - 0x9a, 0xbc, 0x9d, 0x80, 0xa6, 0x5d, 0xb1, 0xc0, - 0x3e, 0x81, 0xe0, 0x52, 0x8f, 0x9a, 0x1a, 0xc2, - 0xdb, 0x9f, 0x91, 0x85, 0x56, 0xdb, 0xb8, 0x69, - 0x10, 0x35, 0xe4, 0xc4, 0xaf, 0xb6, 0x13, 0xf8, - 0x86, 0xe1, 0x2d, 0x3c, 0xf8, 0x94, 0x60, 0xb7, - 0xa1, 0xde, 0x25, 0x51, 0x7d, 0xff, 0xff, 0xa6, - 0x23, 0x68, 0x28, 0x1f, 0x79, 0x33, 0x60, 0x86, - 0xe9, 0x2c, 0x3a, 0xb9, 0x3c, 0x70, 0xb3, 0xe0, - 0x4c, 0x8c, 0x7e, 0x06, 0xdf, 0x4d, 0xf6, 0x88, - 0xda, 0x9e, 0x4f, 0x5b, 0xd2, 0x2e, 0x28, 0xb8, - 0xe0, 0x27, 0x7a, 0x43, 0xfb, 0x23, 0x4b, 0x8a, - 0xd9, 0x4f, 0x29, 0x53, 0x5d, 0x75, 0xc6, 0xfc }; - uint8_t smbbuf2[] = { - 0x0a, 0x30, 0xe0, 0x74, 0x3c, 0x23, 0xc3, 0x11, - 0x95, 0x25, 0x04, 0xe4, 0x2d, 0x7b, 0x29, 0xa1, - 0x75, 0x69, 0x3f, 0x49, 0x9c, 0xfa, 0x66, 0x78, - 0x3c, 0xf1, 0xab, 0xee, 0xab, 0x9a, 0x75, 0x63, - 0x54, 0x80, 0x2b, 0x5c, 0x07, 0xf7, 0xec, 0x72, - 0xfb, 0xd0, 0x52, 0x5e, 0x7e, 0x99, 0xf5, 0x3b, - 0xc4, 0x77, 0x96, 0x12, 0xb8, 0x36, 0xb2, 0xcf, - 0xab, 0xf5, 0xd3, 0xf3, 0x19, 0x77, 0xbb, 0x03, - 0xdb, 0xf7, 0x4d, 0x81, 0xe3, 0xe8, 0x6c, 0x23, - 0x02, 0xe0, 0xcf, 0x24, 0xc1, 0xd5, 0x3d, 0x42, - 0xa4, 0xbc, 0x97, 0xf4, 0x83, 0xee, 0xff, 0x85, - 0x2c, 0xfd, 0xdd, 0xdc, 0x23, 0x1c, 0x87, 0x0c, - 0xe4, 0xd5, 0xfc, 0xc3, 0x8b, 0x10, 0xa5, 0x42, - 0x0f, 0x14, 0xd1, 0x89, 0xa6, 0xaf, 0xaa, 0x77, - 0xfc, 0x3b, 0xce, 0x6c, 0xbe, 0x62, 0xc9, 0xdd, - 0x16, 0xc6, 0x14, 0xc2, 0xa6, 0x13, 0x12, 0xfa, - 0x5a, 0x8b, 0x05, 0x88, 0x06, 0xf9, 0xef, 0x9c, - 0xce, 0xf7, 0x27, 0x46, 0x1d, 0x50, 0xe2, 0xeb, - 0x49, 0xb2, 0xb1, 0x7c, 0x6b, 0xaf, 0xe9, 0xc7, - 0xdd, 0x59, 0x8c, 0xda, 0x32, 0x55, 0xb5, 0xfe, - 0xdc, 0xe0, 0x47, 0xf4, 0xa0, 0xe7, 0xaa, 0x47, - 0x49, 0xdf, 0xcf, 0x9c, 0xd6, 0xfa, 0xd2, 0xca, - 0x55, 0xa7, 0x3f, 0x62, 0x14, 0x6c, 0xc8, 0x7f, - 0xad, 0x7c, 0xb1, 0x70, 0x88, 0xb3, 0x51, 0x13, - 0x2c, 0x3b, 0x78, 0x1d, 0xa2, 0x5e, 0xf7, 0x83, - 0x62, 0x6a, 0x51, 0xbd, 0xe9, 0x77, 0x62, 0xc6, - 0x06, 0x06, 0x51, 0x9d, 0x03, 0x95, 0x51, 0x7c, - 0xd3, 0x73, 0x50, 0x9b, 0x36, 0x5a, 0x28, 0x52, - 0xc0, 0x05, 0xee, 0xd5, 0x2d, 0xd5, 0x77, 0x52, - 0xab, 0x7c, 0x4a, 0x4c, 0x7e, 0xf6, 0xba, 0x52, - 0xc5, 0x4d, 0xb5, 0x74, 0x83, 0x77, 0x5f, 0xaa, - 0xba, 0x86, 0x94, 0xd2, 0x19, 0xca, 0xef, 0xc9, - 0x6e, 0x5b, 0x50, 0xee, 0x2c, 0xdd, 0x67, 0xc8, - 0xfd, 0xc3, 0xa4, 0x80, 0x63, 0x1d, 0xa2, 0x07, - 0x1e, 0x1a, 0x9d, 0x70, 0xe4, 0xab, 0x34, 0x7a, - 0xfb, 0x08, 0x82, 0x85, 0xec, 0x2d, 0x25, 0x3e, - 0x70, 0x22, 0x6e, 0x9d, 0x0f, 0xed, 0x60, 0x8f, - 0xc5, 0x06, 0x66, 0x42, 0x95, 0xcc, 0x77, 0xbe, - 0x4d, 0x19, 0x7c, 0xd1, 0x31, 0x26, 0xfb, 0x52, - 0xad, 0xbd, 0x19, 0x1d, 0x68, 0x56, 0x2c, 0xb9, - 0x5b, 0xaa, 0x92, 0x48, 0xcf, 0xdf, 0x65, 0x2d, - 0xdb, 0x87, 0x06, 0xbe, 0x51, 0x61, 0x6b, 0xf6, - 0x87, 0xdc, 0xbb, 0xa5, 0x48, 0x81, 0xaf, 0xd7, - 0xfc, 0x15, 0xf7, 0x41, 0xde, 0xe3, 0xe9, 0xd4, - 0xad, 0x5d, 0x64, 0x8f, 0x13, 0x68, 0xe5, 0x2b, - 0x4d, 0x87, 0x59, 0x7e, 0xcb, 0x2b, 0xbf, 0xbc, - 0xaa, 0xd2, 0xc7, 0x60, 0xef, 0xe1, 0x25, 0xe2, - 0x89, 0xb4, 0x78, 0x24, 0x52, 0xb4, 0x54, 0xe3, - 0xf0, 0xe5, 0x81, 0xba, 0xe3, 0x00, 0x62, 0x09, - 0x8a, 0x19, 0x7b, 0x9b, 0x0f, 0x50, 0x91, 0xa7, - 0x80, 0xdb, 0x0e, 0x68, 0xe1, 0x22, 0x54, 0x89, - 0x07, 0xc7, 0x39, 0x38, 0xca, 0xae, 0xbf, 0x5b, - 0xbb, 0xe4, 0x70, 0x28, 0xc5, 0x18, 0x98, 0xea }; - uint8_t smbbuf3[] = { - 0x39, 0x99, 0x97, 0x1f, 0xf1, 0x6a, 0x72, 0x0d, - 0x35, 0xd5, 0x33, 0x42, 0x5a, 0x9f, 0xea, 0x0f, - 0x6f, 0x3b, 0xc7, 0xb9, 0xd3, 0x04, 0xdf, 0x44, - 0x45, 0xc7, 0xc6, 0x06, 0x0b, 0x77, 0x8e, 0x8e, - 0x9a, 0x3c, 0xa4, 0x15, 0x85, 0x80, 0xce, 0xd0, - 0x8c, 0x54, 0x60, 0xf9, 0x1f, 0xb3, 0x3e, 0xed, - 0x21, 0x3e, 0xfa, 0x30, 0xf4, 0x50, 0x2b, 0x00, - 0x00, 0xea, 0xd1, 0xb3, 0xd2, 0x7e, 0x6c, 0x14, - 0xe5, 0xf0, 0xf4, 0x9c, 0xb4, 0x2e, 0x32, 0x41, - 0x20, 0x2a, 0x18, 0x78, 0x1a, 0xed, 0x04, 0x94, - 0x83, 0xd1, 0x87, 0x39, 0xf6, 0xcb, 0xf4, 0xc1, - 0xc7, 0xe0, 0x50, 0x87, 0x65, 0x4f, 0x36, 0x73, - 0x70, 0xf5, 0x0a, 0xaa, 0x2b, 0x28, 0xad, 0x05, - 0x28, 0x8d, 0x3b, 0x42, 0xfb, 0xe2, 0xd3, 0xb8, - 0x82, 0x71, 0x25, 0xcd, 0xa2, 0xf2, 0x4b, 0x62, - 0xeb, 0x14, 0x3b, 0x81, 0xaf, 0xd4, 0x68, 0x5a, - 0xae, 0x8e, 0x10, 0x9a, 0x17, 0x4c, 0xf1, 0x3d, - 0x43, 0xb9, 0xd2, 0xd5, 0x86, 0xee, 0x3a, 0xf3, - 0xe5, 0x41, 0xe5, 0x52, 0xda, 0x61, 0xf3, 0x20, - 0x30, 0x5b, 0xe5, 0x1f, 0xe2, 0x4e, 0x9d, 0xd6, - 0xd6, 0x2e, 0x2a, 0x63, 0xbc, 0xf6, 0xb9, 0xc2, - 0xec, 0xd0, 0xe9, 0xfd, 0x07, 0xfb, 0x2d, 0x8e, - 0xbc, 0x43, 0xcb, 0x7e, 0x55, 0x63, 0x9f, 0xb6, - 0xf8, 0x8b, 0x4c, 0xcd, 0x4b, 0x28, 0x47, 0x56, - 0xc9, 0xd2, 0xfe, 0x0e, 0x63, 0x11, 0x09, 0xd9, - 0xd9, 0x97, 0x0a, 0x5a, 0x21, 0xad, 0xdb, 0x53, - 0x24, 0xee, 0x62, 0x4a, 0xaa, 0x49, 0x14, 0xdf, - 0xc0, 0x61, 0x85, 0x11, 0x57, 0x6e, 0x3b, 0x8c, - 0x37, 0x24, 0x13, 0xde, 0xc7, 0xf3, 0x44, 0x54, - 0x8a, 0x69, 0x78, 0x0c, 0xf3, 0xd1, 0xcd, 0xc5, - 0xad, 0x45, 0xc6, 0x06, 0x56, 0x0b, 0x53, 0x40, - 0x79, 0x12, 0x90, 0x6b, 0xdf, 0xc5, 0x80, 0xde, - 0x9c, 0x8e, 0xe1, 0x73, 0xdc, 0x92, 0xc2, 0xf1, - 0xeb, 0xd9, 0x66, 0x0a, 0x12, 0xd2, 0x3f, 0x04, - 0x03, 0xaa, 0x6f, 0xd0, 0x90, 0xfa, 0xb0, 0x6b, - 0x7d, 0xfc, 0x76, 0xf9, 0xe3, 0xa2, 0x17, 0x28, - 0x4e, 0x9d, 0x2d, 0xa6, 0x7e, 0xfa, 0x19, 0x91, - 0xeb, 0xe5, 0xe4, 0xca, 0x09, 0x77, 0xfe, 0xc0, - 0x1c, 0xaa, 0xc4, 0x7c, 0xc2, 0x6a, 0x0e, 0xf3, - 0x4e, 0x79, 0x9b, 0x82, 0x2a, 0x4b, 0xd3, 0x35, - 0x1d, 0x92, 0x6c, 0x3f, 0x85, 0x57, 0x5a, 0x16, - 0xa1, 0x0d, 0xc7, 0x64, 0xb8, 0x46, 0x73, 0xbf, - 0x91, 0x5f, 0x10, 0x2a, 0x2b, 0x51, 0x49, 0xe1, - 0xea, 0xda, 0x2f, 0x41, 0x7b, 0x96, 0xa3, 0xd2, - 0x7b, 0x72, 0xc0, 0x88, 0x84, 0xcb, 0xe0, 0xb7, - 0xae, 0x74, 0xc9, 0x78, 0x82, 0x47, 0xf3, 0x19, - 0x21, 0x53, 0xe6, 0xe1, 0x67, 0xbb, 0x39, 0x05, - 0x6e, 0x1c, 0x38, 0x33, 0x10, 0x60, 0x24, 0x48, - 0xb2, 0x7a, 0xb9, 0x4e, 0x8d, 0x36, 0xcf, 0xce, - 0xf6, 0x31, 0x3b, 0xa3, 0x18, 0x78, 0x49, 0x91, - 0xef, 0xed, 0x86, 0x2c, 0x98, 0x00, 0x18, 0x49, - 0x73, 0xb8, 0xe5, 0x2f, 0xc1, 0x58, 0xe0, 0x47, - 0x2b, 0x16, 0x41, 0xc3, 0x41, 0x05, 0x00, 0x0b, - 0x03, 0x10, 0x00, 0x00, 0x00, 0xb0, 0x02, 0x00, - 0x00, 0x00, 0x00 }; - - uint32_t smblen1 = sizeof(smbbuf1); - uint32_t smblen2 = sizeof(smbbuf2); - uint32_t smblen3 = sizeof(smbbuf3); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - int r = 0; - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->smb.command != SMB_COM_WRITE_ANDX) { - printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_WRITE_ANDX, smb_state->smb.command); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, - smbbuf2, smblen2); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, - smbbuf3, smblen3); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - printUUID("BIND", smb_state->ds.dcerpc.dcerpcbindbindack.uuid_entry); - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest04(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf1[] = { - 0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, - 0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, - 0x00, 0x08, 0x00, 0x00, 0x0e, 0xff, 0x00, 0x00, - 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xff, - 0x00, 0x00, 0x00, 0x08, 0x00, 0x48, 0x00, 0x00, - 0x00, 0x48, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x49, 0x00, 0xab, 0x05, 0x00, 0x0b, 0x03, - 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, - 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x78, 0x56, 0x34, 0x12, - 0x34, 0x12, 0xcd, 0xab, 0xef, 0x00, 0x01, 0x23, - 0x45, 0x67, 0x89, 0xab, 0x01, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 }; - uint8_t smbbuf2[] = { - 0x00, 0x00, 0x00, 0x2f, 0xff, 0x53, 0x4d, 0x42, - 0x2f, 0x00, 0x00, 0x00, 0x00, 0x98, 0x07, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, - 0x00, 0x08, 0x00, 0x00, 0x06, 0xff, 0x00, 0x2f, - 0x00, 0x48, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00 }; - uint8_t smbbuf3[] = { - 0x00, 0x00, 0x00, 0x3b, 0xff, 0x53, 0x4d, 0x42, - 0x2e, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, - 0x00, 0x08, 0x00, 0x00, 0x0c, 0xff, 0x00, 0xde, - 0xde, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x00, 0x04, 0xff, 0xff, 0xff, 0xff, 0x00, - 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; - uint8_t smbbuf4[] = { - 0x00, 0x00, 0x00, 0x80, 0xff, 0x53, 0x4d, 0x42, - 0x2e, 0x00, 0x00, 0x00, 0x00, 0x98, 0x03, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, - 0x00, 0x08, 0x00, 0x00, 0x0c, 0xff, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, - 0x00, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, - 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, - 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xb8, 0x10, 0xb8, 0x10, 0x5d, 0xe0, 0x00, 0x00, - 0x0e, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, - 0x73, 0x70, 0x6f, 0x6f, 0x6c, 0x73, 0x73, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, - 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, - 0x02, 0x00, 0x00, 0x00 }; - uint32_t smblen1 = sizeof(smbbuf1); - uint32_t smblen2 = sizeof(smbbuf2); - uint32_t smblen3 = sizeof(smbbuf3); - uint32_t smblen4 = sizeof(smbbuf4); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - int r = 0; - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->smb.command != SMB_COM_WRITE_ANDX) { - printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_WRITE_ANDX, smb_state->smb.command); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, - smbbuf2, smblen2); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, - smbbuf3, smblen3); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, - smbbuf4, smblen4); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest05(void) -{ - AppLayerProtoDetectUnittestCtxBackup(); - AppLayerProtoDetectSetup(); - - uint8_t smbbuf1[] = { - /* session request */ - 0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, - 0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, - 0x46, 0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, - 0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00 - }; - uint32_t smblen1 = sizeof(smbbuf1); - uint8_t smbbuf2[] = { - /* session request */ - 0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, - 0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, - 0x46, 0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, - 0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00, - /* session message */ - 0x00, 0x00, 0x00, 0x60, 0xff, 0x53, 0x4d, 0x42, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x2d, - 0x00, 0x00, 0xdd, 0xca, 0x00, 0x3d, 0x00, 0x02, - 0x4d, 0x45, 0x54, 0x41, 0x53, 0x50, 0x4c, 0x4f, - 0x49, 0x54, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, - 0x41, 0x4e, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x4c, - 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, 0x32, - 0x00, 0x02, 0x4e, 0x54, 0x20, 0x4c, 0x41, 0x4e, - 0x4d, 0x41, 0x4e, 0x20, 0x31, 0x2e, 0x30, 0x00, - 0x02, 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, - 0x2e, 0x31, 0x32, 0x00 - }; - uint32_t smblen2 = sizeof(smbbuf2); - - int result = 0; - AppProto alproto; - Flow f; - AppLayerProtoDetectThreadCtx *alpd_tctx; - memset(&f, 0, sizeof(f)); - f.dp = 139; - - /** SMB */ - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT); - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOSERVER); - - /** SMB2 */ - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT); - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOSERVER); - - AppLayerProtoDetectPPRegister(IPPROTO_TCP, - "139", - ALPROTO_SMB, - SMB_PROBING_PARSER_MIN_DEPTH, 0, - STREAM_TOSERVER, - SMBProbingParser, NULL); - - AppLayerProtoDetectPrepareState(); - alpd_tctx = AppLayerProtoDetectGetCtxThread(); - - bool reverse_flow = false; - alproto = AppLayerProtoDetectGetProto(alpd_tctx, - &f, - smbbuf1, smblen1, - IPPROTO_TCP, STREAM_TOSERVER, &reverse_flow); - if (alproto != ALPROTO_UNKNOWN) { - printf("alproto is %"PRIu16 ". Should be ALPROTO_UNKNOWN\n", - alproto); - goto end; - } - - alproto = AppLayerProtoDetectGetProto(alpd_tctx, - &f, - smbbuf2, smblen2, - IPPROTO_TCP, STREAM_TOSERVER, &reverse_flow); - if (alproto != ALPROTO_SMB) { - printf("alproto is %"PRIu16 ". Should be ALPROTO_SMB\n", - alproto); - goto end; - } - - result = 1; - end: - AppLayerProtoDetectDeSetup(); - AppLayerProtoDetectUnittestCtxRestore(); - if (alpd_tctx != NULL) - AppLayerProtoDetectDestroyCtxThread(alpd_tctx); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest06(void) -{ - AppLayerProtoDetectUnittestCtxBackup(); - AppLayerProtoDetectSetup(); - - uint8_t smbbuf1[] = { - /* session request */ - 0x83, 0x00, 0x00, 0x01, 0x82 - }; - uint32_t smblen1 = sizeof(smbbuf1); - uint8_t smbbuf2[] = { - /* session request */ - 0x83, 0x00, 0x00, 0x01, 0x82, - /* session message */ - 0x00, 0x00, 0x00, 0x55, 0xff, 0x53, 0x4d, 0x42, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x98, 0x53, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, - 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03, - 0x0a, 0x00, 0x01, 0x00, 0x04, 0x11, 0x00, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xfd, 0xe3, 0x00, 0x80, 0xb8, 0xcb, 0x22, 0x5f, - 0xfd, 0xeb, 0xc3, 0x01, 0x68, 0x01, 0x00, 0x10, - 0x00, 0x50, 0xb5, 0xc3, 0x62, 0x59, 0x02, 0xd1, - 0x4d, 0x99, 0x6d, 0x85, 0x7d, 0xfa, 0x93, 0x2d, - 0xbb - }; - uint32_t smblen2 = sizeof(smbbuf2); - - int result = 0; - AppProto alproto; - Flow f; - AppLayerProtoDetectThreadCtx *alpd_tctx; - memset(&f, 0, sizeof(f)); - f.dp = 139; - - /** SMB */ - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT); - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOSERVER); - - /** SMB2 */ - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT); - AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOSERVER); - - AppLayerProtoDetectPPRegister(IPPROTO_TCP, - "139", - ALPROTO_SMB, - SMB_PROBING_PARSER_MIN_DEPTH, 0, - STREAM_TOSERVER, - SMBProbingParser, NULL); - - AppLayerProtoDetectPrepareState(); - alpd_tctx = AppLayerProtoDetectGetCtxThread(); - - bool reverse_flow = false; - alproto = AppLayerProtoDetectGetProto(alpd_tctx, - &f, - smbbuf1, smblen1, - IPPROTO_TCP, STREAM_TOSERVER, &reverse_flow); - if (alproto != ALPROTO_UNKNOWN) { - printf("alproto is %"PRIu16 ". Should be ALPROTO_UNKNOWN\n", - alproto); - goto end; - } - - alproto = AppLayerProtoDetectGetProto(alpd_tctx, - &f, - smbbuf2, smblen2, - IPPROTO_TCP, STREAM_TOSERVER, &reverse_flow); - if (alproto != ALPROTO_SMB) { - printf("alproto is %"PRIu16 ". Should be ALPROTO_SMB\n", - alproto); - goto end; - } - - result = 1; - end: - AppLayerProtoDetectDeSetup(); - AppLayerProtoDetectUnittestCtxRestore(); - if (alpd_tctx != NULL) - AppLayerProtoDetectDestroyCtxThread(alpd_tctx); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest07(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf1[] = { - /* negative session response */ - 0x83, 0x00, 0x00, 0x01, 0x82 - }; - uint32_t smblen1 = sizeof(smbbuf1); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - int r = 0; - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOCLIENT | STREAM_START, smbbuf1, smblen1); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->smb.command != 0) { - printf("we shouldn't have any smb state as yet\n"); - goto end; - } - - if (smb_state->nbss.length != 1 || - smb_state->nbss.type != NBSS_NEGATIVE_SESSION_RESPONSE) { - printf("something wrong with nbss parsing\n"); - goto end; - } - - if (smb_state->bytesprocessed != 0) { - printf("smb parser bytesprocessed should be 0, but it is not\n"); - goto end; - } - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest08(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf1[] = { - /* positive session response */ - 0x82, 0x00, 0x00, 0x00 - }; - uint8_t smbbuf2[] = { - /* negotiate protocol */ - 0x00, 0x00, 0x00, 0x55, 0xff, 0x53, 0x4d, 0x42, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x98, 0x53, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, - 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03, - 0x0a, 0x00, 0x01, 0x00, 0x04, 0x11, 0x00, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xfd, 0xe3, 0x00, 0x80, 0x40, 0x8a, 0x57, 0x5c, - 0xfd, 0xeb, 0xc3, 0x01, 0x68, 0x01, 0x00, 0x10, - 0x00, 0x50, 0xb5, 0xc3, 0x62, 0x59, 0x02, 0xd1, - 0x4d, 0x99, 0x6d, 0x85, 0x7d, 0xfa, 0x93, 0x2d, - 0xbb - }; - uint32_t smblen1 = sizeof(smbbuf1); - uint32_t smblen2 = sizeof(smbbuf2); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - int r = 0; - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOCLIENT | STREAM_START, smbbuf1, smblen1); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->smb.command != 0) { - printf("we shouldn't have any smb state as yet\n"); - goto end; - } - - if (smb_state->nbss.length != 0 || - smb_state->nbss.type != NBSS_POSITIVE_SESSION_RESPONSE) { - printf("something wrong with nbss parsing\n"); - goto end; - } - - if (smb_state->bytesprocessed != 0) { - printf("smb parser bytesprocessed should be 0, but it is not\n"); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOCLIENT, - smbbuf2, smblen2); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - if (smb_state->smb.command != SMB_COM_NEGOTIATE) { - printf("we should expect SMB command 0x%02x , got 0x%02x : ", - SMB_COM_NEGOTIATE, smb_state->smb.command); - goto end; - } - - if (smb_state->nbss.length != 85 || - smb_state->nbss.type != NBSS_SESSION_MESSAGE) { - printf("something wrong with nbss parsing\n"); - goto end; - } - - if (smb_state->bytesprocessed != 0) { - printf("smb parser bytesprocessed should be 0, but it is not\n"); - goto end; - } - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -static int SMBParserTest09(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf1[] = { - /* session request */ - 0x81, 0x00, 0x00, 0x44, 0x20, 0x45, 0x44, 0x45, - 0x4a, 0x46, 0x44, 0x45, 0x44, 0x45, 0x50, 0x43, - 0x4e, 0x46, 0x48, 0x44, 0x43, 0x45, 0x4c, 0x43, - 0x4e, 0x46, 0x43, 0x46, 0x45, 0x45, 0x4e, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x45, - 0x44, 0x45, 0x4a, 0x46, 0x44, 0x45, 0x44, 0x45, - 0x50, 0x43, 0x4e, 0x46, 0x49, 0x46, 0x41, 0x43, - 0x4e, 0x46, 0x43, 0x46, 0x45, 0x45, 0x4e, 0x43, - 0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00 - }; - uint8_t smbbuf2[] = { - /* session service - negotiate protocol */ - 0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, - 0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f, - 0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52, - 0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02, - 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, - 0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f, - 0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57, - 0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70, - 0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02, - 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, - 0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, - 0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54, - 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, - 0x00 - }; - uint32_t smblen1 = sizeof(smbbuf1); - uint32_t smblen2 = sizeof(smbbuf2); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - int r = 0; - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->smb.command != 0) { - printf("we shouldn't have any smb state as yet\n"); - goto end; - } - - if (smb_state->nbss.length != 68 || - smb_state->nbss.type != NBSS_SESSION_REQUEST) { - printf("something wrong with nbss parsing\n"); - goto end; - } - - if (smb_state->bytesprocessed != 0) { - printf("smb parser bytesprocessed should be 0, but it is not\n"); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, - smbbuf2, smblen2); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - if (smb_state->smb.command != SMB_COM_NEGOTIATE) { - printf("we should expect SMB command 0x%02x , got 0x%02x : ", - SMB_COM_NEGOTIATE, smb_state->smb.command); - goto end; - } - - if (smb_state->nbss.length != 133 || - smb_state->nbss.type != NBSS_SESSION_MESSAGE) { - printf("something wrong with nbss parsing\n"); - goto end; - } - - if (smb_state->bytesprocessed != 0) { - printf("smb parser bytesprocessed should be 0, but it is not\n"); - goto end; - } - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -/** - * \test Test to temporarily to show the direction demaraction issue in the - * smb parser. - */ -static int SMBParserTest10(void) -{ - int result = 0; - Flow f; - uint8_t smbbuf1[] = { - /* partial request */ - 0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, - 0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f, - 0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52, - 0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02, - 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, - 0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f, - 0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57, - 0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70, - 0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02, - 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, - 0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, - }; - //0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54, - //0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, - //0x00 - - uint8_t smbbuf2[] = { - /* response */ - 0x00, 0x00, 0x00, 0x55, 0xff, 0x53, 0x4d, 0x42, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x98, 0x53, 0xc8, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, - 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03, - 0x32, 0x00, 0x01, 0x00, 0x04, 0x41, 0x00, 0x00, - 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xfd, 0xf3, 0x00, 0x80, 0x20, 0x03, 0x1a, 0x2d, - 0x77, 0x98, 0xc5, 0x01, 0xa4, 0x01, 0x00, 0x10, - 0x00, 0xb7, 0xeb, 0x0b, 0x05, 0x21, 0x22, 0x50, - 0x42, 0x8c, 0x38, 0x2a, 0x7f, 0xc5, 0x6a, 0x7c, - 0x0c - }; - uint32_t smblen1 = sizeof(smbbuf1); - uint32_t smblen2 = sizeof(smbbuf2); - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - int r = 0; - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - FLOW_INITIALIZE(&f); - f.protoctx = (void *)&ssn; - f.proto = IPPROTO_TCP; - f.alproto = ALPROTO_SMB; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, - STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); - if (r != 0) { - printf("smb header check returned %" PRId32 ", expected 0: ", r); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMBState *smb_state = f.alstate; - if (smb_state == NULL) { - printf("no smb state: "); - goto end; - } - - if (smb_state->bytesprocessed == 0) { - printf("request - smb parser bytesprocessed should not be 0.\n"); - goto end; - } - - FLOWLOCK_WRLOCK(&f); - r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOCLIENT, - smbbuf2, smblen2); - if (r == 0) { - printf("smb parser didn't return fail\n"); - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - result = 1; -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - FLOW_DESTROY(&f); - return result; -} - -#endif - -void SMBParserRegisterTests(void) -{ -#ifdef UNITTESTS - UtRegisterTest("SMBParserTest01", SMBParserTest01); - UtRegisterTest("SMBParserTest02", SMBParserTest02); - UtRegisterTest("SMBParserTest03", SMBParserTest03); - UtRegisterTest("SMBParserTest04", SMBParserTest04); - UtRegisterTest("SMBParserTest05", SMBParserTest05); - UtRegisterTest("SMBParserTest06", SMBParserTest06); - UtRegisterTest("SMBParserTest07", SMBParserTest07); - UtRegisterTest("SMBParserTest08", SMBParserTest08); - UtRegisterTest("SMBParserTest09", SMBParserTest09); - UtRegisterTest("SMBParserTest10", SMBParserTest10); -#endif -} -#endif /* HAVE_RUST */ - diff --git a/src/app-layer-smb.h b/src/app-layer-smb.h deleted file mode 100644 index 929d3c9214..0000000000 --- a/src/app-layer-smb.h +++ /dev/null @@ -1,171 +0,0 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Kirby Kuehl - */ -#ifndef __APP_LAYER_SMB_H__ -#define __APP_LAYER_SMB_H__ - -#include "suricata-common.h" -#include "app-layer-protos.h" -#include "app-layer-parser.h" -#include "flow.h" -#include "stream.h" -#include "app-layer-nbss.h" -#include "app-layer-dcerpc-common.h" -#include "app-layer-dcerpc.h" - -#ifndef HAVE_RUST - -typedef struct SMBHdr_ { - uint8_t protocol[4]; - uint8_t command; - uint32_t status; - uint8_t flags; - uint16_t flags2; - uint16_t pidhigh; - uint64_t securitysignature; - uint16_t unused; - uint16_t tid; - uint16_t pid; - uint16_t uid; - uint16_t mid; -} SMBHdr; - -#define SMB_HDR_LEN 32 -#define MINIMUM_SMB_LEN 35 -#define NBSS_SMB_HDRS_LEN 36 - -typedef struct SMBWordCount_ { - uint8_t wordcount; - uint8_t wordcountleft; - uint8_t *words; -} SMBWordCount; - -typedef struct SMBByteCount_ { - uint8_t bytecountbytes; - uint16_t bytecount; - uint16_t bytecountleft; - uint8_t *bytes; -} SMBByteCount; - -typedef struct SMBAndX_ { - uint8_t isandx; - uint8_t paddingparsed; - uint8_t andxcommand; - uint8_t maxchainedandx; - uint16_t andxoffset; - uint16_t andxbytesprocessed; - uint16_t datalength; - uint16_t datalengthhigh; - uint64_t dataoffset; -} SMBAndX; - -typedef struct SMBState_ { - NBSSHdr nbss; - uint16_t transaction_id; - uint16_t bytesprocessed; - SMBHdr smb; - SMBWordCount wordcount; - SMBByteCount bytecount; - SMBAndX andx; - DCERPCState ds; - uint8_t dcerpc_present; - uint8_t data_needed_for_dir; -} SMBState; - -#define SMB_FLAGS_SERVER_TO_REDIR 0x80 -#define SMB_NO_SECONDARY_ANDX_COMMAND 0xff - -/* http://msdn.microsoft.com/en-us/library/dd327674.aspx */ -#define SMB_COM_CREATE_DIRECTORY 0x00 -#define SMB_COM_DELETE_DIRECTORY 0x01 -#define SMB_COM_OPEN 0x02 -#define SMB_COM_CREATE 0x03 -#define SMB_COM_CLOSE 0x04 -#define SMB_COM_FLUSH 0x05 -#define SMB_COM_DELETE 0x06 -#define SMB_COM_RENAME 0x07 -#define SMB_COM_QUERY_INFORMATION 0x08 -#define SMB_COM_SET_INFORMATION 0x09 -#define SMB_COM_READ 0x0A -#define SMB_COM_WRITE 0x0B -#define SMB_COM_LOCK_BYTE_RANGE 0x0C -#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D -#define SMB_COM_CREATE_TEMPORARY 0x0E -#define SMB_COM_CREATE_NEW 0x0F -#define SMB_COM_CHECK_DIRECTORY 0x10 -#define SMB_COM_PROCESS_EXIT 0x11 -#define SMB_COM_SEEK 0x12 -#define SMB_COM_LOCK_AND_READ 0x13 -#define SMB_COM_WRITE_AND_UNLOCK 0x14 -#define SMB_COM_READ_RAW 0x1A -#define SMB_COM_READ_MPX 0x1B -#define SMB_COM_READ_MPX_SECONDARY 0x1C -#define SMB_COM_WRITE_RAW 0x1D -#define SMB_COM_WRITE_MPX 0x1E -#define SMB_COM_WRITE_COMPLETE 0x20 -#define SMB_COM_SET_INFORMATION2 0x22 -#define SMB_COM_QUERY_INFORMATION2 0x23 -#define SMB_COM_LOCKING_ANDX 0x24 -#define SMB_COM_TRANSACTION 0x25 -#define SMB_COM_TRANSACTION_SECONDARY 0x26 -#define SMB_COM_IOCTL 0x27 -#define SMB_COM_IOCTL_SECONDARY 0x28 -#define SMB_COM_COPY 0x29 -#define SMB_COM_MOVE 0x2A -#define SMB_COM_ECHO 0x2B -#define SMB_COM_WRITE_AND_CLOSE 0x2C -#define SMB_COM_OPEN_ANDX 0x2D -#define SMB_COM_READ_ANDX 0x2E -#define SMB_COM_WRITE_ANDX 0x2F -#define SMB_COM_CLOSE_AND_TREE_DISC 0x31 -#define SMB_COM_TRANSACTION2 0x32 -#define SMB_COM_TRANSACTION2_SECONDARY 0x33 -#define SMB_COM_FIND_CLOSE2 0x34 -#define SMB_COM_FIND_NOTIFY_CLOSE 0x35 -#define SMB_COM_TREE_CONNECT 0x70 -#define SMB_COM_TREE_DISCONNECT 0x71 -#define SMB_COM_NEGOTIATE 0x72 -#define SMB_COM_SESSION_SETUP_ANDX 0x73 -#define SMB_COM_LOGOFF_ANDX 0x74 -#define SMB_COM_TREE_CONNECT_ANDX 0x75 -#define SMB_COM_QUERY_INFORMATION_DISK 0x80 -#define SMB_COM_SEARCH 0x81 -#define SMB_COM_FIND 0x82 -#define SMB_COM_FIND_UNIQUE 0x83 -#define SMB_COM_NT_TRANSACT 0xA0 -#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1 -#define SMB_COM_NT_CREATE_ANDX 0xA2 -#define SMB_COM_NT_CANCEL 0xA4 -#define SMB_COM_NT_RENAME 0xA5 -#define SMB_COM_OPEN_PRINT_FILE 0xC0 -#define SMB_COM_WRITE_PRINT_FILE 0xC1 -#define SMB_COM_CLOSE_PRINT_FILE 0xC2 -#define SMB_COM_GET_PRINT_QUEUE 0xC3 - -int isAndX(SMBState *smb_state); -#endif /* HAVE_RUST */ - -void RegisterSMBParsers(void); -void SMBParserRegisterTests(void); - -#endif /* __APP_LAYER_SMB_H__ */ - diff --git a/src/app-layer-smb2.c b/src/app-layer-smb2.c deleted file mode 100644 index 8248690816..0000000000 --- a/src/app-layer-smb2.c +++ /dev/null @@ -1,692 +0,0 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Kirby Kuehl - * - * SMBv2 parser/decoder - */ - -#include "suricata-common.h" - -#include "debug.h" -#include "decode.h" -#include "threads.h" - -#include "util-print.h" -#include "util-pool.h" - -#include "stream-tcp-private.h" -#include "stream-tcp-reassemble.h" -#include "stream-tcp.h" -#include "stream.h" - -#include "app-layer.h" -#include "app-layer-protos.h" -#include "app-layer-parser.h" - -#include "util-spm.h" -#include "util-unittest.h" -#include "util-debug.h" -#include "util-memcmp.h" - -#include "app-layer-smb2.h" - -enum { - SMB2_FIELD_NONE = 0, - SMB2_PARSE_NBSS_HEADER, - SMB2_PARSE_SMB_HEADER, - - /* must be last */ - SMB_FIELD_MAX, -}; - -static uint32_t NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len) -{ - SCEnter(); - SMB2State *sstate = (SMB2State *) smb2_state; - uint8_t *p = input; - - if (input_len && sstate->bytesprocessed < NBSS_HDR_LEN - 1) { - switch (sstate->bytesprocessed) { - case 0: - /* Initialize */ - if (input_len >= NBSS_HDR_LEN) { - sstate->nbss.type = *p; - sstate->nbss.length = (*(p + 1) & 0x01) << 16; - sstate->nbss.length |= *(p + 2) << 8; - sstate->nbss.length |= *(p + 3); - sstate->bytesprocessed += NBSS_HDR_LEN; - SCReturnUInt(4U); - } else { - sstate->nbss.type = *(p++); - if (!(--input_len)) - break; - } - /* fall through */ - case 1: - sstate->nbss.length = (*(p++) & 0x01) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 2: - sstate->nbss.length |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 3: - sstate->nbss.length |= *(p++); - --input_len; - break; - } - sstate->bytesprocessed += (p - input); - } - SCReturnUInt((uint32_t)(p - input)); -} - -static uint32_t SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len) -{ - SCEnter(); - - SMB2State *sstate = (SMB2State *) smb2_state; - uint8_t *p = input; - - if (input_len) { - switch (sstate->bytesprocessed) { - case 4: - // fallthrough - /* above statement to prevent coverity FPs from the switch - * fall through */ - if (input_len >= SMB2_HDR_LEN) { - if (SCMemcmp(p, "\xfe\x53\x4d\x42", 4) != 0) { - //printf("SMB2 Header did not validate\n"); - return 0; - } - sstate->smb2.StructureSize = *(p + 4); - sstate->smb2.StructureSize |= *(p + 5) << 8; - sstate->smb2.CreditCharge = *(p + 6); - sstate->smb2.CreditCharge |= *(p + 7) << 8; - sstate->smb2.Status = *(p + 8); - sstate->smb2.Status |= *(p + 9) << 8; - sstate->smb2.Status |= *(p + 10) << 16; - sstate->smb2.Status |= *(p + 11) << 24; - sstate->smb2.Command = *(p + 12); - sstate->smb2.Command |= *(p + 13) << 8; - sstate->smb2.CreditRequestResponse = *(p + 14); - sstate->smb2.CreditRequestResponse |= *(p + 15) << 8; - sstate->smb2.Flags = *(p + 16); - sstate->smb2.Flags |= *(p + 17) << 8; - sstate->smb2.Flags |= *(p + 18) << 16; - sstate->smb2.Flags |= *(p + 19) << 24; - sstate->smb2.NextCommand = *(p + 20); - sstate->smb2.NextCommand |= *(p + 21) << 8; - sstate->smb2.NextCommand |= *(p + 22) << 16; - sstate->smb2.NextCommand |= *(p + 23) << 24; - sstate->smb2.MessageId = *(p + 24); - sstate->smb2.MessageId |= *(p + 25) << 8; - sstate->smb2.MessageId |= *(p + 26) << 16; - sstate->smb2.MessageId |= (uint64_t) *(p + 27) << 24; - sstate->smb2.MessageId |= (uint64_t) *(p + 28) << 32; - sstate->smb2.MessageId |= (uint64_t) *(p + 29) << 40; - sstate->smb2.MessageId |= (uint64_t) *(p + 30) << 48; - sstate->smb2.MessageId |= (uint64_t) *(p + 31) << 56; - sstate->smb2.ProcessId = *(p + 32); - sstate->smb2.ProcessId |= *(p + 33) << 8; - sstate->smb2.ProcessId |= *(p + 34) << 16; - sstate->smb2.ProcessId |= *(p + 35) << 24; - sstate->smb2.TreeId = *(p + 36); - sstate->smb2.TreeId |= *(p + 37) << 8; - sstate->smb2.TreeId |= *(p + 38) << 16; - sstate->smb2.TreeId |= *(p + 39) << 24; - sstate->smb2.SessionId = *(p + 40); - sstate->smb2.SessionId |= *(p + 41) << 8; - sstate->smb2.SessionId |= *(p + 42) << 16; - sstate->smb2.SessionId |= (uint64_t) *(p + 43) << 24; - sstate->smb2.SessionId |= (uint64_t) *(p + 44) << 32; - sstate->smb2.SessionId |= (uint64_t) *(p + 45) << 40; - sstate->smb2.SessionId |= (uint64_t) *(p + 46) << 48; - sstate->smb2.SessionId |= (uint64_t) *(p + 47) << 56; - sstate->smb2.Signature[0] = *(p + 48); - sstate->smb2.Signature[1] = *(p + 49); - sstate->smb2.Signature[2] = *(p + 50); - sstate->smb2.Signature[3] = *(p + 51); - sstate->smb2.Signature[4] = *(p + 52); - sstate->smb2.Signature[5] = *(p + 53); - sstate->smb2.Signature[6] = *(p + 54); - sstate->smb2.Signature[7] = *(p + 55); - sstate->smb2.Signature[8] = *(p + 56); - sstate->smb2.Signature[9] = *(p + 57); - sstate->smb2.Signature[10] = *(p + 58); - sstate->smb2.Signature[11] = *(p + 59); - sstate->smb2.Signature[12] = *(p + 60); - sstate->smb2.Signature[13] = *(p + 61); - sstate->smb2.Signature[14] = *(p + 62); - sstate->smb2.Signature[15] = *(p + 63); - sstate->bytesprocessed += SMB2_HDR_LEN; - SCReturnUInt(64U); - break; - } else { - //sstate->smb2.protocol[0] = *(p++); - if (*(p++) != 0xfe) - return 0; - if (!(--input_len)) - break; - /* We fall through to the next case if we still have input. - * Same applies for other cases as well */ - } - /* fall through */ - case 5: - //sstate->smb2.protocol[1] = *(p++); - if (*(p++) != 'S') - return 0; - if (!(--input_len)) - break; - /* fall through */ - case 6: - //sstate->smb2.protocol[2] = *(p++); - if (*(p++) != 'M') - return 0; - if (!(--input_len)) - break; - /* fall through */ - case 7: - //sstate->smb2.protocol[3] = *(p++); - if (*(p++) != 'B') - return 0; - if (!(--input_len)) - break; - /* fall through */ - case 8: - sstate->smb2.StructureSize = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 9: - sstate->smb2.StructureSize |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 10: - sstate->smb2.CreditCharge = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 11: - sstate->smb2.CreditCharge |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 12: - sstate->smb2.Status = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 13: - sstate->smb2.Status |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 14: - sstate->smb2.Status |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 15: - sstate->smb2.Status |= *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 16: - sstate->smb2.Command = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 17: - sstate->smb2.Command |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 18: - sstate->smb2.CreditRequestResponse = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 19: - sstate->smb2.CreditRequestResponse |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 20: - sstate->smb2.Flags = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 21: - sstate->smb2.Flags |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 22: - sstate->smb2.Flags |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 23: - sstate->smb2.Flags |= *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 24: - sstate->smb2.NextCommand = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 25: - sstate->smb2.NextCommand |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 26: - sstate->smb2.NextCommand |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 27: - sstate->smb2.NextCommand |= *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 28: - sstate->smb2.MessageId = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 29: - sstate->smb2.MessageId = *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 30: - sstate->smb2.MessageId = *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 31: - sstate->smb2.MessageId = (uint64_t) *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 32: - sstate->smb2.MessageId = (uint64_t) *(p++) << 32; - if (!(--input_len)) - break; - /* fall through */ - case 33: - sstate->smb2.MessageId = (uint64_t) *(p++) << 40; - if (!(--input_len)) - break; - /* fall through */ - case 34: - sstate->smb2.MessageId = (uint64_t) *(p++) << 48; - if (!(--input_len)) - break; - /* fall through */ - case 35: - sstate->smb2.MessageId = (uint64_t) *(p++) << 56; - if (!(--input_len)) - break; - /* fall through */ - case 36: - sstate->smb2.ProcessId = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 37: - sstate->smb2.ProcessId |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 38: - sstate->smb2.ProcessId |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 39: - sstate->smb2.ProcessId |= *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 40: - sstate->smb2.TreeId = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 41: - sstate->smb2.TreeId |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 42: - sstate->smb2.TreeId |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 43: - sstate->smb2.TreeId |= *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 44: - sstate->smb2.SessionId = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 45: - sstate->smb2.SessionId |= *(p++) << 8; - if (!(--input_len)) - break; - /* fall through */ - case 46: - sstate->smb2.SessionId |= *(p++) << 16; - if (!(--input_len)) - break; - /* fall through */ - case 47: - sstate->smb2.SessionId |= (uint64_t) *(p++) << 24; - if (!(--input_len)) - break; - /* fall through */ - case 48: - sstate->smb2.SessionId |= (uint64_t) *(p++) << 32; - if (!(--input_len)) - break; - /* fall through */ - case 49: - sstate->smb2.SessionId |= (uint64_t) *(p++) << 40; - if (!(--input_len)) - break; - /* fall through */ - case 50: - sstate->smb2.SessionId |= (uint64_t) *(p++) << 48; - if (!(--input_len)) - break; - /* fall through */ - case 51: - sstate->smb2.SessionId |= (uint64_t) *(p++) << 56; - if (!(--input_len)) - break; - /* fall through */ - case 52: - sstate->smb2.Signature[0] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 53: - sstate->smb2.Signature[1] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 54: - sstate->smb2.Signature[2] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 55: - sstate->smb2.Signature[3] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 56: - sstate->smb2.Signature[4] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 57: - sstate->smb2.Signature[5] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 58: - sstate->smb2.Signature[6] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 59: - sstate->smb2.Signature[7] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 60: - sstate->smb2.Signature[8] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 61: - sstate->smb2.Signature[9] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 62: - sstate->smb2.Signature[10] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 63: - sstate->smb2.Signature[11] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 64: - sstate->smb2.Signature[12] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 65: - sstate->smb2.Signature[13] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 66: - sstate->smb2.Signature[14] = *(p++); - if (!(--input_len)) - break; - /* fall through */ - case 67: - sstate->smb2.Signature[15] = *(p++); - --input_len; - break; - /* fall through */ - } - } - sstate->bytesprocessed += (p - input); - SCReturnUInt((uint32_t)(p - input)); -} - -static int SMB2Parse(Flow *f, void *smb2_state, AppLayerParserState *pstate, - uint8_t *input, uint32_t input_len, - void *local_data, const uint8_t flags) -{ - SCEnter(); - SMB2State *sstate = (SMB2State *) smb2_state; - uint32_t retval = 0; - uint32_t parsed = 0; - - if (pstate == NULL) - return -1; - - if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { - SCReturnInt(1); - } else if (input == NULL || input_len == 0) { - SCReturnInt(-1); - } - - while (sstate->bytesprocessed < NBSS_HDR_LEN && input_len) { - retval = NBSSParseHeader(smb2_state, pstate, input, input_len); - if (retval <= input_len) { - parsed += retval; - input_len -= retval; - } else { - return -1; - } - - SCLogDebug("NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %u input_len %u", - sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type, - sstate->nbss.length, parsed, input_len); - } - - switch(sstate->nbss.type) { - case NBSS_SESSION_MESSAGE: - while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN && - sstate->bytesprocessed < NBSS_HDR_LEN + SMB2_HDR_LEN)) { - retval = SMB2ParseHeader(smb2_state, pstate, input + parsed, input_len); - if (retval <= input_len) { - parsed += retval; - input_len -= retval; - } else { - return -1; - } - - SCLogDebug("SMB2 Header (%u/%u) Command 0x%04x parsed %u input_len %u", - sstate->bytesprocessed, NBSS_HDR_LEN + SMB2_HDR_LEN, - sstate->smb2.Command, parsed, input_len); - } - break; - default: - break; - } - SCReturnInt(1); -} - - -static void *SMB2StateAlloc(void) -{ - void *s = SCMalloc(sizeof(SMB2State)); - if (unlikely(s == NULL)) - return NULL; - - memset(s, 0, sizeof(SMB2State)); - return s; -} - -static void SMB2StateFree(void *s) -{ - if (s) { - SCFree(s); - s = NULL; - } -} - -void RegisterSMB2Parsers(void) -{ - /** SMB2 */ - const char *proto_name = "smb2"; - - if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { - AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB2, STREAM_TOSERVER, SMB2Parse); - AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB2, STREAM_TOCLIENT, SMB2Parse); - AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SMB2, SMB2StateAlloc, SMB2StateFree); - } else { - SCLogInfo("Parsed disabled for %s protocol. Protocol detection" - "still on.", proto_name); - } - -#ifdef UNITTESTS - AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB2, SMB2ParserRegisterTests); -#endif - return; -} - -/* UNITTESTS */ -#ifdef UNITTESTS - -static int SMB2ParserTest01(void) -{ - int result = 1; - Flow f; - uint8_t smb2buf[] = - "\x00\x00\x00\x66" // NBSS - "\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00" // SMB2 - "\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - "\x24\x00\x01\x00x00\x00\x00\x00\x00\x00\x0\x00\x00\x00\x00\x00\x00\x00\x00" - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x02"; - - uint32_t smb2len = sizeof(smb2buf) - 1; - TcpSession ssn; - AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); - - memset(&f, 0, sizeof(f)); - memset(&ssn, 0, sizeof(ssn)); - f.protoctx = (void *)&ssn; - - StreamTcpInitConfig(TRUE); - - FLOWLOCK_WRLOCK(&f); - int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB2, - STREAM_TOSERVER | STREAM_EOF, smb2buf, - smb2len); - if (r != 0) { - printf("smb2 header check returned %" PRId32 ", expected 0: ", r); - result = 0; - FLOWLOCK_UNLOCK(&f); - goto end; - } - FLOWLOCK_UNLOCK(&f); - - SMB2State *smb2_state = f.alstate; - if (smb2_state == NULL) { - printf("no smb2 state: "); - result = 0; - goto end; - } - - if (smb2_state->nbss.type != NBSS_SESSION_MESSAGE) { - printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb2_state->nbss.type); - result = 0; - goto end; - } - - if (smb2_state->nbss.length != 102) { - printf("expected nbss length 0x%02x , got 0x%02x : ", 102, smb2_state->nbss.length); - result = 0; - goto end; - } - - if (smb2_state->smb2.Command != SMB2_NEGOTIATE) { - printf("expected SMB2 command 0x%04x , got 0x%04x : ", SMB2_NEGOTIATE, smb2_state->smb2.Command); - result = 0; - goto end; - } - -end: - if (alp_tctx != NULL) - AppLayerParserThreadCtxFree(alp_tctx); - StreamTcpFreeConfig(TRUE); - return result; -} - -void SMB2ParserRegisterTests(void) -{ - UtRegisterTest("SMB2ParserTest01", SMB2ParserTest01); -} -#endif - diff --git a/src/app-layer-smb2.h b/src/app-layer-smb2.h deleted file mode 100644 index 2eb86ca6db..0000000000 --- a/src/app-layer-smb2.h +++ /dev/null @@ -1,83 +0,0 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Kirby Kuehl - */ - -#ifndef __APP_LAYER_SMB2_H__ -#define __APP_LAYER_SMB2_H__ - -#include "suricata-common.h" -#include "app-layer-protos.h" -#include "app-layer-parser.h" -#include "app-layer-nbss.h" -#include "flow.h" -#include "stream.h" - -typedef struct SMB2Hdr { - uint32_t Protocol; /**< Contains 0xFE,'SMB' */ - uint16_t StructureSize; - uint16_t CreditCharge; - uint32_t Status; - uint16_t Command; - uint16_t CreditRequestResponse; - uint32_t Flags; - uint32_t NextCommand; - uint64_t MessageId; - uint32_t ProcessId; - uint32_t TreeId; - uint64_t SessionId; - uint8_t Signature[16]; -} SMB2Hdr; - -#define SMB2_HDR_LEN 64 - -typedef struct SMB2State_ { - NBSSHdr nbss; - SMB2Hdr smb2; - uint16_t bytesprocessed; -} SMB2State; - -/** from http://msdn.microsoft.com/en-us/library/cc246528(PROT.13).aspx */ -#define SMB2_NEGOTIATE 0x0000 -#define SMB2_SESSION_SETUP 0x0001 -#define SMB2_LOGOFF 0x0002 -#define SMB2_TREE_CONNECT 0x0003 -#define SMB2_TREE_DISCONNECT 0x0004 -#define SMB2_CREATE 0x0005 -#define SMB2_CLOSE 0x0006 -#define SMB2_FLUSH 0x0007 -#define SMB2_READ 0x0008 -#define SMB2_WRITE 0x0009 -#define SMB2_LOCK 0x000A -#define SMB2_IOCTL 0x000B -#define SMB2_CANCEL 0x000C -#define SMB2_ECHO 0x000D -#define SMB2_QUERY_DIRECTORY 0x000E -#define SMB2_CHANGE_NOTIFY 0x000F -#define SMB2_QUERY_INFO 0x0010 -#define SMB2_SET_INFO 0x0011 -#define SMB2_OPLOCK_BREAK 0x0012 - -void RegisterSMB2Parsers(void); -void SMB2ParserRegisterTests(void); - -#endif /* __APP_LAYER_SMB2_H__ */ - diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c index 7715239b89..16714330a3 100644 --- a/src/detect-dce-iface.c +++ b/src/detect-dce-iface.c @@ -246,26 +246,9 @@ static DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg) return NULL; } -#include "app-layer-smb.h" DCERPCState *DetectDceGetState(AppProto alproto, void *alstate) { -#ifdef HAVE_RUST return alstate; -#else - switch (alproto) { - case ALPROTO_DCERPC: - return alstate; - case ALPROTO_SMB: { - SMBState *smb_state = (SMBState *)alstate; - return &smb_state->ds; - } - case ALPROTO_SMB2: - // not implemented - return NULL; - } - - return NULL; -#endif } /** diff --git a/src/detect-engine-file.c b/src/detect-engine-file.c index 20e770d569..0b1fdead11 100644 --- a/src/detect-engine-file.c +++ b/src/detect-engine-file.c @@ -42,7 +42,6 @@ #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-htp.h" -#include "app-layer-smb.h" #include "app-layer-dcerpc-common.h" #include "app-layer-dcerpc.h" #include "app-layer-smtp.h" diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c index a715057056..000936f7fd 100644 --- a/src/detect-engine-state.c +++ b/src/detect-engine-state.c @@ -56,7 +56,6 @@ #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-htp.h" -#include "app-layer-smb.h" #include "app-layer-dcerpc-common.h" #include "app-layer-dcerpc.h" #include "app-layer-dns-common.h" diff --git a/src/detect.c b/src/detect.c index b7c5aa26fc..2280f766fa 100644 --- a/src/detect.c +++ b/src/detect.c @@ -812,8 +812,8 @@ static inline void DetectRulePacketRules( if (likely(sflags & SIG_FLAG_APPLAYER)) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != scratch->alproto) { if (s->alproto == ALPROTO_DCERPC) { - if (scratch->alproto != ALPROTO_SMB && scratch->alproto != ALPROTO_SMB2) { - SCLogDebug("DCERPC sig, alproto not SMB or SMB2"); + if (scratch->alproto != ALPROTO_SMB) { + SCLogDebug("DCERPC sig, alproto not SMB"); goto next; } } else { diff --git a/src/runmode-unittests.c b/src/runmode-unittests.c index 715cc72a73..39f4ad64fe 100644 --- a/src/runmode-unittests.c +++ b/src/runmode-unittests.c @@ -58,7 +58,6 @@ #include "app-layer-detect-proto.h" #include "app-layer-parser.h" #include "app-layer.h" -#include "app-layer-smb.h" #include "app-layer-dcerpc.h" #include "app-layer-dcerpc-udp.h" #include "app-layer-htp.h" diff --git a/src/suricata.c b/src/suricata.c index 4f9e49c796..c165114512 100644 --- a/src/suricata.c +++ b/src/suricata.c @@ -123,7 +123,6 @@ #include "app-layer-ssh.h" #include "app-layer-ftp.h" #include "app-layer-smtp.h" -#include "app-layer-smb.h" #include "app-layer-modbus.h" #include "app-layer-enip.h" #include "app-layer-dnp3.h"