suricata
app-layer-smb.c File Reference

SMBv1 parser/decoder. More...

#include "suricata-common.h"
#include "debug.h"
#include "decode.h"
#include "threads.h"
#include "util-print.h"
#include "util-pool.h"
#include "util-debug.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer.h"
#include "app-layer-detect-proto.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-dcerpc.h"
#include "util-spm.h"
#include "util-unittest.h"
#include "util-memcmp.h"
#include "app-layer-smb.h"
#include "flow-util.h"
Include dependency graph for app-layer-smb.c:

Go to the source code of this file.

Macros

#define SMB_PROBING_PARSER_MIN_DEPTH   8
 

Enumerations

enum  {
  SMB_FIELD_NONE = 0, SMB_PARSE_NBSS_HEADER, SMB_PARSE_SMB_HEADER, SMB_PARSE_GET_WORDCOUNT,
  SMB_PARSE_WORDCOUNT, SMB_PARSE_GET_BYTECOUNT, SMB_PARSE_BYTECOUNT, SMB_FIELD_MAX
}
 

Functions

int isAndX (SMBState *smb_state)
 determines if the SMB command is an ANDX command More...
 
void RegisterSMBParsers (void)
 
void SMBParserRegisterTests (void)
 

Detailed Description

SMBv1 parser/decoder.

Author
Kirby Kuehl kkueh.nosp@m.l@gm.nosp@m.ail.c.nosp@m.om

Definition in file app-layer-smb.c.

Macro Definition Documentation

#define SMB_PROBING_PARSER_MIN_DEPTH   8

Definition at line 1513 of file app-layer-smb.c.

Referenced by RegisterSMBParsers().

Enumeration Type Documentation

anonymous enum
Enumerator
SMB_FIELD_NONE 
SMB_PARSE_NBSS_HEADER 
SMB_PARSE_SMB_HEADER 
SMB_PARSE_GET_WORDCOUNT 
SMB_PARSE_WORDCOUNT 
SMB_PARSE_GET_BYTECOUNT 
SMB_PARSE_BYTECOUNT 
SMB_FIELD_MAX 

Definition at line 63 of file app-layer-smb.c.

Function Documentation

int isAndX ( SMBState smb_state)
void RegisterSMBParsers ( void  )

Definition at line 1572 of file app-layer-smb.c.

References Flow_::alproto, ALPROTO_SMB, ALPROTO_SMB2, ALPROTO_UNKNOWN, Flow_::alstate, AppLayerParserConfParserEnabled(), AppLayerParserParse(), AppLayerParserRegisterDetectStateFuncs(), AppLayerParserRegisterGetStateProgressCompletionStatus(), AppLayerParserRegisterGetStateProgressFunc(), AppLayerParserRegisterGetTx(), AppLayerParserRegisterGetTxCnt(), AppLayerParserRegisterParser(), AppLayerParserRegisterParserAcceptableDataDirection(), AppLayerParserRegisterProtocolUnittests(), AppLayerParserRegisterStateFuncs(), AppLayerParserRegisterTxFreeFunc(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), AppLayerProtoDetectConfProtoDetectionEnabled(), AppLayerProtoDetectDeSetup(), AppLayerProtoDetectDestroyCtxThread(), AppLayerProtoDetectGetCtxThread(), AppLayerProtoDetectGetProto(), AppLayerProtoDetectPMRegisterPatternCS(), AppLayerProtoDetectPPParseConfPorts(), AppLayerProtoDetectPPRegister(), AppLayerProtoDetectPrepareState(), AppLayerProtoDetectRegisterProtocol(), AppLayerProtoDetectSetup(), AppLayerProtoDetectUnittestCtxBackup(), AppLayerProtoDetectUnittestCtxRestore(), SMBState_::bytesprocessed, SMBHdr_::command, DCERPCState_::dcerpc, DCERPC_::dcerpcbindbindack, Flow_::dp, SMBState_::ds, FLOW_DESTROY, FLOW_INITIALIZE, FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, NBSSHdr_::length, SMBState_::nbss, NBSS_NEGATIVE_SESSION_RESPONSE, NBSS_POSITIVE_SESSION_RESPONSE, NBSS_SESSION_MESSAGE, NBSS_SESSION_REQUEST, printUUID(), Flow_::proto, Flow_::protoctx, RunmodeIsUnittests(), SCLogInfo, SMBState_::smb, SMB_COM_NEGOTIATE, SMB_COM_TRANSACTION, SMB_COM_WRITE_ANDX, SMB_PROBING_PARSER_MIN_DEPTH, SMBParserRegisterTests(), STREAM_EOF, STREAM_START, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), TRUE, NBSSHdr_::type, and DCERPCBindBindAck_::uuid_entry.

Referenced by AppLayerParserRegisterProtocolParsers(), and RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

void SMBParserRegisterTests ( void  )

Definition at line 2802 of file app-layer-smb.c.

References UtRegisterTest().

Referenced by RegisterSMBParsers().

Here is the call graph for this function:

Here is the caller graph for this function: