/src/suricata8/rust/src/smb/smb2_session.rs
Line | Count | Source |
1 | | /* Copyright (C) 2018-2026 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | use crate::smb::smb2_records::*; |
19 | | use crate::smb::smb::*; |
20 | | use crate::smb::events::*; |
21 | | use crate::smb::auth::*; |
22 | | |
23 | 48.3k | pub fn smb2_session_setup_request(state: &mut SMBState, r: &Smb2Record) |
24 | | { |
25 | | SCLogDebug!("SMB2_COMMAND_SESSION_SETUP: r.data.len() {}", r.data.len()); |
26 | | #[allow(clippy::single_match)] |
27 | 48.3k | match parse_smb2_request_session_setup(r.data) { |
28 | 47.1k | Ok((_, setup)) => { |
29 | 47.1k | let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER); |
30 | 47.1k | let Some(tx) = state.new_sessionsetup_tx(hdr) else { |
31 | 2 | return; |
32 | | }; |
33 | 47.1k | tx.vercmd.set_smb2_cmd(r.command); |
34 | | |
35 | 47.1k | if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data { |
36 | 47.1k | if let Some(s) = parse_secblob(setup.data) { |
37 | 67 | td.ntlmssp = s.ntlmssp; |
38 | 67 | td.krb_ticket = s.krb; |
39 | 67 | if let Some(ntlm) = &td.ntlmssp { |
40 | 64 | if ntlm.warning { |
41 | 60 | tx.set_event(SMBEvent::UnusualNtlmsspOrder); |
42 | 60 | } |
43 | 3 | } |
44 | 47.0k | } |
45 | 0 | } |
46 | | }, |
47 | 1.22k | _ => { |
48 | 1.22k | // events.push(SMBEvent::MalformedData); |
49 | 1.22k | }, |
50 | | } |
51 | 48.3k | } |
52 | | |
53 | 655 | fn smb2_session_setup_update_tx(tx: &mut SMBTransaction, r: &Smb2Record) |
54 | | { |
55 | 655 | tx.hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER); // to overwrite ssn_id 0 |
56 | 655 | tx.set_status(r.nt_status, false); |
57 | 655 | tx.response_done = true; |
58 | 655 | } |
59 | | |
60 | 4.03k | pub fn smb2_session_setup_response(state: &mut SMBState, r: &Smb2Record) |
61 | | { |
62 | | // try exact match with session id already set (e.g. NTLMSSP AUTH phase) |
63 | 4.03k | let found = r.session_id != 0 && match state.get_sessionsetup_tx( |
64 | 3.92k | SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER)) |
65 | | { |
66 | 540 | Some(tx) => { |
67 | 540 | smb2_session_setup_update_tx(tx, r); |
68 | | SCLogDebug!("smb2_session_setup_response: tx {:?}", tx); |
69 | 540 | true |
70 | | }, |
71 | 3.38k | None => { false }, |
72 | | }; |
73 | | // otherwise try match with ssn id 0 (e.g. NTLMSSP_NEGOTIATE) |
74 | 4.03k | if !found { |
75 | 3.49k | if let Some(tx) = state.get_sessionsetup_tx( |
76 | 3.49k | SMBCommonHdr::new(SMBHDR_TYPE_HEADER, 0, 0, r.message_id)) |
77 | 115 | { |
78 | 115 | smb2_session_setup_update_tx(tx, r); |
79 | 115 | SCLogDebug!("smb2_session_setup_response: tx {:?}", tx); |
80 | 3.38k | } else { |
81 | 3.38k | SCLogDebug!("smb2_session_setup_response: tx not found for {:?}", r); |
82 | 3.38k | } |
83 | 540 | } |
84 | 4.03k | } |