suricata
app-layer-smb.h File Reference
#include "suricata-common.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "flow.h"
#include "stream.h"
#include "app-layer-nbss.h"
#include "app-layer-dcerpc-common.h"
#include "app-layer-dcerpc.h"
Include dependency graph for app-layer-smb.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  SMBHdr_
 
struct  SMBWordCount_
 
struct  SMBByteCount_
 
struct  SMBAndX_
 
struct  SMBState_
 

Macros

#define SMB_HDR_LEN   32
 
#define MINIMUM_SMB_LEN   35
 
#define NBSS_SMB_HDRS_LEN   36
 
#define SMB_FLAGS_SERVER_TO_REDIR   0x80
 
#define SMB_NO_SECONDARY_ANDX_COMMAND   0xff
 
#define SMB_COM_CREATE_DIRECTORY   0x00
 
#define SMB_COM_DELETE_DIRECTORY   0x01
 
#define SMB_COM_OPEN   0x02
 
#define SMB_COM_CREATE   0x03
 
#define SMB_COM_CLOSE   0x04
 
#define SMB_COM_FLUSH   0x05
 
#define SMB_COM_DELETE   0x06
 
#define SMB_COM_RENAME   0x07
 
#define SMB_COM_QUERY_INFORMATION   0x08
 
#define SMB_COM_SET_INFORMATION   0x09
 
#define SMB_COM_READ   0x0A
 
#define SMB_COM_WRITE   0x0B
 
#define SMB_COM_LOCK_BYTE_RANGE   0x0C
 
#define SMB_COM_UNLOCK_BYTE_RANGE   0x0D
 
#define SMB_COM_CREATE_TEMPORARY   0x0E
 
#define SMB_COM_CREATE_NEW   0x0F
 
#define SMB_COM_CHECK_DIRECTORY   0x10
 
#define SMB_COM_PROCESS_EXIT   0x11
 
#define SMB_COM_SEEK   0x12
 
#define SMB_COM_LOCK_AND_READ   0x13
 
#define SMB_COM_WRITE_AND_UNLOCK   0x14
 
#define SMB_COM_READ_RAW   0x1A
 
#define SMB_COM_READ_MPX   0x1B
 
#define SMB_COM_READ_MPX_SECONDARY   0x1C
 
#define SMB_COM_WRITE_RAW   0x1D
 
#define SMB_COM_WRITE_MPX   0x1E
 
#define SMB_COM_WRITE_COMPLETE   0x20
 
#define SMB_COM_SET_INFORMATION2   0x22
 
#define SMB_COM_QUERY_INFORMATION2   0x23
 
#define SMB_COM_LOCKING_ANDX   0x24
 
#define SMB_COM_TRANSACTION   0x25
 
#define SMB_COM_TRANSACTION_SECONDARY   0x26
 
#define SMB_COM_IOCTL   0x27
 
#define SMB_COM_IOCTL_SECONDARY   0x28
 
#define SMB_COM_COPY   0x29
 
#define SMB_COM_MOVE   0x2A
 
#define SMB_COM_ECHO   0x2B
 
#define SMB_COM_WRITE_AND_CLOSE   0x2C
 
#define SMB_COM_OPEN_ANDX   0x2D
 
#define SMB_COM_READ_ANDX   0x2E
 
#define SMB_COM_WRITE_ANDX   0x2F
 
#define SMB_COM_CLOSE_AND_TREE_DISC   0x31
 
#define SMB_COM_TRANSACTION2   0x32
 
#define SMB_COM_TRANSACTION2_SECONDARY   0x33
 
#define SMB_COM_FIND_CLOSE2   0x34
 
#define SMB_COM_FIND_NOTIFY_CLOSE   0x35
 
#define SMB_COM_TREE_CONNECT   0x70
 
#define SMB_COM_TREE_DISCONNECT   0x71
 
#define SMB_COM_NEGOTIATE   0x72
 
#define SMB_COM_SESSION_SETUP_ANDX   0x73
 
#define SMB_COM_LOGOFF_ANDX   0x74
 
#define SMB_COM_TREE_CONNECT_ANDX   0x75
 
#define SMB_COM_QUERY_INFORMATION_DISK   0x80
 
#define SMB_COM_SEARCH   0x81
 
#define SMB_COM_FIND   0x82
 
#define SMB_COM_FIND_UNIQUE   0x83
 
#define SMB_COM_NT_TRANSACT   0xA0
 
#define SMB_COM_NT_TRANSACT_SECONDARY   0xA1
 
#define SMB_COM_NT_CREATE_ANDX   0xA2
 
#define SMB_COM_NT_CANCEL   0xA4
 
#define SMB_COM_NT_RENAME   0xA5
 
#define SMB_COM_OPEN_PRINT_FILE   0xC0
 
#define SMB_COM_WRITE_PRINT_FILE   0xC1
 
#define SMB_COM_CLOSE_PRINT_FILE   0xC2
 
#define SMB_COM_GET_PRINT_QUEUE   0xC3
 

Typedefs

typedef struct SMBHdr_ SMBHdr
 
typedef struct SMBWordCount_ SMBWordCount
 
typedef struct SMBByteCount_ SMBByteCount
 
typedef struct SMBAndX_ SMBAndX
 
typedef struct SMBState_ SMBState
 

Functions

int isAndX (SMBState *smb_state)
 determines if the SMB command is an ANDX command More...
 
void RegisterSMBParsers (void)
 
void SMBParserRegisterTests (void)
 

Detailed Description

Author
Kirby Kuehl kkueh.nosp@m.l@gm.nosp@m.ail.c.nosp@m.om

Definition in file app-layer-smb.h.

Macro Definition Documentation

#define MINIMUM_SMB_LEN   35

Definition at line 53 of file app-layer-smb.h.

#define NBSS_SMB_HDRS_LEN   36

Definition at line 54 of file app-layer-smb.h.

#define SMB_COM_CHECK_DIRECTORY   0x10

Definition at line 114 of file app-layer-smb.h.

#define SMB_COM_CLOSE   0x04

Definition at line 102 of file app-layer-smb.h.

#define SMB_COM_CLOSE_AND_TREE_DISC   0x31

Definition at line 139 of file app-layer-smb.h.

#define SMB_COM_CLOSE_PRINT_FILE   0xC2

Definition at line 161 of file app-layer-smb.h.

#define SMB_COM_COPY   0x29

Definition at line 132 of file app-layer-smb.h.

#define SMB_COM_CREATE   0x03

Definition at line 101 of file app-layer-smb.h.

#define SMB_COM_CREATE_DIRECTORY   0x00

Definition at line 98 of file app-layer-smb.h.

#define SMB_COM_CREATE_NEW   0x0F

Definition at line 113 of file app-layer-smb.h.

#define SMB_COM_CREATE_TEMPORARY   0x0E

Definition at line 112 of file app-layer-smb.h.

#define SMB_COM_DELETE   0x06

Definition at line 104 of file app-layer-smb.h.

#define SMB_COM_DELETE_DIRECTORY   0x01

Definition at line 99 of file app-layer-smb.h.

#define SMB_COM_ECHO   0x2B

Definition at line 134 of file app-layer-smb.h.

#define SMB_COM_FIND   0x82

Definition at line 152 of file app-layer-smb.h.

#define SMB_COM_FIND_CLOSE2   0x34

Definition at line 142 of file app-layer-smb.h.

#define SMB_COM_FIND_NOTIFY_CLOSE   0x35

Definition at line 143 of file app-layer-smb.h.

#define SMB_COM_FIND_UNIQUE   0x83

Definition at line 153 of file app-layer-smb.h.

#define SMB_COM_FLUSH   0x05

Definition at line 103 of file app-layer-smb.h.

#define SMB_COM_GET_PRINT_QUEUE   0xC3

Definition at line 162 of file app-layer-smb.h.

#define SMB_COM_IOCTL   0x27

Definition at line 130 of file app-layer-smb.h.

#define SMB_COM_IOCTL_SECONDARY   0x28

Definition at line 131 of file app-layer-smb.h.

#define SMB_COM_LOCK_AND_READ   0x13

Definition at line 117 of file app-layer-smb.h.

#define SMB_COM_LOCK_BYTE_RANGE   0x0C

Definition at line 110 of file app-layer-smb.h.

#define SMB_COM_LOCKING_ANDX   0x24

Definition at line 127 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_LOGOFF_ANDX   0x74

Definition at line 148 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_MOVE   0x2A

Definition at line 133 of file app-layer-smb.h.

#define SMB_COM_NEGOTIATE   0x72

Definition at line 146 of file app-layer-smb.h.

Referenced by RegisterSMBParsers().

#define SMB_COM_NT_CANCEL   0xA4

Definition at line 157 of file app-layer-smb.h.

#define SMB_COM_NT_CREATE_ANDX   0xA2

Definition at line 156 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_NT_RENAME   0xA5

Definition at line 158 of file app-layer-smb.h.

#define SMB_COM_NT_TRANSACT   0xA0

Definition at line 154 of file app-layer-smb.h.

#define SMB_COM_NT_TRANSACT_SECONDARY   0xA1

Definition at line 155 of file app-layer-smb.h.

#define SMB_COM_OPEN   0x02

Definition at line 100 of file app-layer-smb.h.

#define SMB_COM_OPEN_ANDX   0x2D

Definition at line 136 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_OPEN_PRINT_FILE   0xC0

Definition at line 159 of file app-layer-smb.h.

#define SMB_COM_PROCESS_EXIT   0x11

Definition at line 115 of file app-layer-smb.h.

#define SMB_COM_QUERY_INFORMATION   0x08

Definition at line 106 of file app-layer-smb.h.

#define SMB_COM_QUERY_INFORMATION2   0x23

Definition at line 126 of file app-layer-smb.h.

#define SMB_COM_QUERY_INFORMATION_DISK   0x80

Definition at line 150 of file app-layer-smb.h.

#define SMB_COM_READ   0x0A

Definition at line 108 of file app-layer-smb.h.

#define SMB_COM_READ_ANDX   0x2E

Definition at line 137 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_READ_MPX   0x1B

Definition at line 120 of file app-layer-smb.h.

#define SMB_COM_READ_MPX_SECONDARY   0x1C

Definition at line 121 of file app-layer-smb.h.

#define SMB_COM_READ_RAW   0x1A

Definition at line 119 of file app-layer-smb.h.

#define SMB_COM_RENAME   0x07

Definition at line 105 of file app-layer-smb.h.

#define SMB_COM_SEARCH   0x81

Definition at line 151 of file app-layer-smb.h.

#define SMB_COM_SEEK   0x12

Definition at line 116 of file app-layer-smb.h.

#define SMB_COM_SESSION_SETUP_ANDX   0x73

Definition at line 147 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_SET_INFORMATION   0x09

Definition at line 107 of file app-layer-smb.h.

#define SMB_COM_SET_INFORMATION2   0x22

Definition at line 125 of file app-layer-smb.h.

#define SMB_COM_TRANSACTION   0x25

Definition at line 128 of file app-layer-smb.h.

Referenced by RegisterSMBParsers().

#define SMB_COM_TRANSACTION2   0x32

Definition at line 140 of file app-layer-smb.h.

#define SMB_COM_TRANSACTION2_SECONDARY   0x33

Definition at line 141 of file app-layer-smb.h.

#define SMB_COM_TRANSACTION_SECONDARY   0x26

Definition at line 129 of file app-layer-smb.h.

#define SMB_COM_TREE_CONNECT   0x70

Definition at line 144 of file app-layer-smb.h.

#define SMB_COM_TREE_CONNECT_ANDX   0x75

Definition at line 149 of file app-layer-smb.h.

Referenced by isAndX().

#define SMB_COM_TREE_DISCONNECT   0x71

Definition at line 145 of file app-layer-smb.h.

#define SMB_COM_UNLOCK_BYTE_RANGE   0x0D

Definition at line 111 of file app-layer-smb.h.

#define SMB_COM_WRITE   0x0B

Definition at line 109 of file app-layer-smb.h.

#define SMB_COM_WRITE_AND_CLOSE   0x2C

Definition at line 135 of file app-layer-smb.h.

#define SMB_COM_WRITE_AND_UNLOCK   0x14

Definition at line 118 of file app-layer-smb.h.

#define SMB_COM_WRITE_ANDX   0x2F

Definition at line 138 of file app-layer-smb.h.

Referenced by isAndX(), and RegisterSMBParsers().

#define SMB_COM_WRITE_COMPLETE   0x20

Definition at line 124 of file app-layer-smb.h.

#define SMB_COM_WRITE_MPX   0x1E

Definition at line 123 of file app-layer-smb.h.

#define SMB_COM_WRITE_PRINT_FILE   0xC1

Definition at line 160 of file app-layer-smb.h.

#define SMB_COM_WRITE_RAW   0x1D

Definition at line 122 of file app-layer-smb.h.

#define SMB_FLAGS_SERVER_TO_REDIR   0x80

Definition at line 94 of file app-layer-smb.h.

#define SMB_HDR_LEN   32

Definition at line 52 of file app-layer-smb.h.

#define SMB_NO_SECONDARY_ANDX_COMMAND   0xff

Definition at line 95 of file app-layer-smb.h.

Referenced by isAndX().

Typedef Documentation

typedef struct SMBAndX_ SMBAndX
typedef struct SMBByteCount_ SMBByteCount
typedef struct SMBHdr_ SMBHdr
typedef struct SMBState_ SMBState
typedef struct SMBWordCount_ SMBWordCount

Function Documentation

int isAndX ( SMBState smb_state)
void RegisterSMBParsers ( void  )

Definition at line 1572 of file app-layer-smb.c.

References Flow_::alproto, ALPROTO_SMB, ALPROTO_SMB2, ALPROTO_UNKNOWN, Flow_::alstate, AppLayerParserConfParserEnabled(), AppLayerParserParse(), AppLayerParserRegisterDetectStateFuncs(), AppLayerParserRegisterGetStateProgressCompletionStatus(), AppLayerParserRegisterGetStateProgressFunc(), AppLayerParserRegisterGetTx(), AppLayerParserRegisterGetTxCnt(), AppLayerParserRegisterParser(), AppLayerParserRegisterParserAcceptableDataDirection(), AppLayerParserRegisterProtocolUnittests(), AppLayerParserRegisterStateFuncs(), AppLayerParserRegisterTxFreeFunc(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), AppLayerProtoDetectConfProtoDetectionEnabled(), AppLayerProtoDetectDeSetup(), AppLayerProtoDetectDestroyCtxThread(), AppLayerProtoDetectGetCtxThread(), AppLayerProtoDetectGetProto(), AppLayerProtoDetectPMRegisterPatternCS(), AppLayerProtoDetectPPParseConfPorts(), AppLayerProtoDetectPPRegister(), AppLayerProtoDetectPrepareState(), AppLayerProtoDetectRegisterProtocol(), AppLayerProtoDetectSetup(), AppLayerProtoDetectUnittestCtxBackup(), AppLayerProtoDetectUnittestCtxRestore(), SMBState_::bytesprocessed, SMBHdr_::command, DCERPCState_::dcerpc, DCERPC_::dcerpcbindbindack, Flow_::dp, SMBState_::ds, FLOW_DESTROY, FLOW_INITIALIZE, FLOWLOCK_UNLOCK, FLOWLOCK_WRLOCK, NBSSHdr_::length, SMBState_::nbss, NBSS_NEGATIVE_SESSION_RESPONSE, NBSS_POSITIVE_SESSION_RESPONSE, NBSS_SESSION_MESSAGE, NBSS_SESSION_REQUEST, printUUID(), Flow_::proto, Flow_::protoctx, RunmodeIsUnittests(), SCLogInfo, SMBState_::smb, SMB_COM_NEGOTIATE, SMB_COM_TRANSACTION, SMB_COM_WRITE_ANDX, SMB_PROBING_PARSER_MIN_DEPTH, SMBParserRegisterTests(), STREAM_EOF, STREAM_START, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), TRUE, NBSSHdr_::type, and DCERPCBindBindAck_::uuid_entry.

Here is the call graph for this function:

void SMBParserRegisterTests ( void  )

Definition at line 2802 of file app-layer-smb.c.

References UtRegisterTest().

Referenced by RegisterSMBParsers().

Here is the call graph for this function:

Here is the caller graph for this function: