Coverage Report

Created: 2026-09-06 07:25

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/suricata8/rust/src/smb/smb2_session.rs
Line
Count
Source
1
/* Copyright (C) 2018-2026 Open Information Security Foundation
2
 *
3
 * You can copy, redistribute or modify this Program under the terms of
4
 * the GNU General Public License version 2 as published by the Free
5
 * Software Foundation.
6
 *
7
 * This program is distributed in the hope that it will be useful,
8
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
10
 * GNU General Public License for more details.
11
 *
12
 * You should have received a copy of the GNU General Public License
13
 * version 2 along with this program; if not, write to the Free Software
14
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
 * 02110-1301, USA.
16
 */
17
18
use crate::smb::smb2_records::*;
19
use crate::smb::smb::*;
20
use crate::smb::events::*;
21
use crate::smb::auth::*;
22
23
48.3k
pub fn smb2_session_setup_request(state: &mut SMBState, r: &Smb2Record)
24
{
25
    SCLogDebug!("SMB2_COMMAND_SESSION_SETUP: r.data.len() {}", r.data.len());
26
    #[allow(clippy::single_match)]
27
48.3k
    match parse_smb2_request_session_setup(r.data) {
28
47.1k
        Ok((_, setup)) => {
29
47.1k
            let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
30
47.1k
            let Some(tx) = state.new_sessionsetup_tx(hdr) else {
31
2
                return;
32
            };
33
47.1k
            tx.vercmd.set_smb2_cmd(r.command);
34
35
47.1k
            if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
36
47.1k
                if let Some(s) = parse_secblob(setup.data) {
37
67
                    td.ntlmssp = s.ntlmssp;
38
67
                    td.krb_ticket = s.krb;
39
67
                    if let Some(ntlm) = &td.ntlmssp {
40
64
                        if ntlm.warning {
41
60
                            tx.set_event(SMBEvent::UnusualNtlmsspOrder);
42
60
                        }
43
3
                    }
44
47.0k
                }
45
0
            }
46
        },
47
1.22k
            _ => {
48
1.22k
//                events.push(SMBEvent::MalformedData);
49
1.22k
        },
50
    }
51
48.3k
}
52
53
655
fn smb2_session_setup_update_tx(tx: &mut SMBTransaction, r: &Smb2Record)
54
{
55
655
    tx.hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER); // to overwrite ssn_id 0
56
655
    tx.set_status(r.nt_status, false);
57
655
    tx.response_done = true;
58
655
}
59
60
4.03k
pub fn smb2_session_setup_response(state: &mut SMBState, r: &Smb2Record)
61
{
62
    // try exact match with session id already set (e.g. NTLMSSP AUTH phase)
63
4.03k
    let found = r.session_id != 0 && match state.get_sessionsetup_tx(
64
3.92k
                SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER))
65
    {
66
540
        Some(tx) => {
67
540
            smb2_session_setup_update_tx(tx, r);
68
            SCLogDebug!("smb2_session_setup_response: tx {:?}", tx);
69
540
            true
70
        },
71
3.38k
        None => { false },
72
    };
73
    // otherwise try match with ssn id 0 (e.g. NTLMSSP_NEGOTIATE)
74
4.03k
    if !found {
75
3.49k
        if let Some(tx) = state.get_sessionsetup_tx(
76
3.49k
                SMBCommonHdr::new(SMBHDR_TYPE_HEADER, 0, 0, r.message_id))
77
115
        {
78
115
            smb2_session_setup_update_tx(tx, r);
79
115
            SCLogDebug!("smb2_session_setup_response: tx {:?}", tx);
80
3.38k
        } else {
81
3.38k
            SCLogDebug!("smb2_session_setup_response: tx not found for {:?}", r);
82
3.38k
        }
83
540
    }
84
4.03k
}