/src/suricata7/rust/src/smb/events.rs
Line | Count | Source |
1 | | /* Copyright (C) 2018 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | use crate::smb::smb::*; |
19 | | |
20 | | #[derive(AppLayerEvent)] |
21 | | pub enum SMBEvent { |
22 | | InternalError, |
23 | | MalformedData, |
24 | | RecordOverflow, |
25 | | MalformedNtlmsspRequest, |
26 | | MalformedNtlmsspResponse, |
27 | | DuplicateNegotiate, |
28 | | NegotiateMalformedDialects, |
29 | | FileOverlap, |
30 | | /// A request was seen in the to client direction. |
31 | | RequestToClient, |
32 | | /// A response was seen in the to server direction, |
33 | | ResponseToServer, |
34 | | |
35 | | /// Negotiated max sizes exceed our limit |
36 | | NegotiateMaxReadSizeTooLarge, |
37 | | NegotiateMaxWriteSizeTooLarge, |
38 | | |
39 | | /// READ request asking for more than `max_read_size` |
40 | | ReadRequestTooLarge, |
41 | | /// READ response bigger than `max_read_size` |
42 | | ReadResponseTooLarge, |
43 | | ReadQueueSizeExceeded, |
44 | | ReadQueueCntExceeded, |
45 | | /// WRITE request for more than `max_write_size` |
46 | | WriteRequestTooLarge, |
47 | | WriteQueueSizeExceeded, |
48 | | WriteQueueCntExceeded, |
49 | | /// Unusual NTLMSSP fields order |
50 | | UnusualNtlmsspOrder, |
51 | | /// Too many live transactions in one flow |
52 | | TooManyTransactions, |
53 | | } |
54 | | |
55 | | impl SMBTransaction { |
56 | | /// Set event. |
57 | 636k | pub fn set_event(&mut self, e: SMBEvent) { |
58 | 636k | self.tx_data.set_event(e as u8); |
59 | 636k | } |
60 | | |
61 | | /// Set events from vector of events. |
62 | 1.45M | pub fn set_events(&mut self, events: Vec<SMBEvent>) { |
63 | 2.52M | for e in events { |
64 | 1.07M | self.tx_data.set_event(e as u8); |
65 | 1.07M | } |
66 | 1.45M | } |
67 | | } |
68 | | |
69 | | impl SMBState { |
70 | | /// Set an event. The event is set on the most recent transaction. |
71 | 83.8k | pub fn set_event(&mut self, event: SMBEvent) { |
72 | 83.8k | let len = self.transactions.len(); |
73 | 83.8k | if len == 0 { |
74 | 29.2k | return; |
75 | 54.5k | } |
76 | | |
77 | 54.5k | let tx = &mut self.transactions[len - 1]; |
78 | 54.5k | tx.set_event(event); |
79 | 83.8k | } |
80 | | } |