smb: fix event handling when no tx is available

rust/src/smb/smb1.rs

@@ -646,7 +646,13 @@ pub fn smb1_trans_response_record<'b>(state: &mut SMBState, r: &SmbRecord<'b>)
     }
 }
 
-/// Handle WRITE and WRITE_ANDX request records
+fn smb1_write_request_record_generic_error<'b>(state: &mut SMBState, r: &SmbRecord<'b>, event: SMBEvent) {
+    let tx_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
+    let tx = state.new_generic_tx(1, r.command as u16, tx_key);
+    tx.set_event(event);
+}
+
+/// Handle WRITE, WRITE_ANDX, WRITE_AND_CLOSE request records
 pub fn smb1_write_request_record<'b>(state: &mut SMBState, r: &SmbRecord<'b>)
 {
     let result = if r.command == SMB1_COMMAND_WRITE_ANDX {
@@ -716,12 +722,12 @@ pub fn smb1_write_request_record<'b>(state: &mut SMBState, r: &SmbRecord<'b>)
             }
         },
         _ => {
-            state.set_event(SMBEvent::MalformedData);
+            smb1_write_request_record_generic_error(state, r, SMBEvent::MalformedData);
         },
     }
 }
 
-fn smb1_read_response_record_generic<'b>(state: &mut SMBState, r: &SmbRecord<'b>) {
+fn smb1_read_response_record_generic<'b>(state: &mut SMBState, r: &SmbRecord<'b>, events: Vec<SMBEvent>) {
     // see if we want a tx per READ command
     if smb1_create_new_tx(r.command) {
         let tx_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
@@ -731,18 +737,16 @@ fn smb1_read_response_record_generic<'b>(state: &mut SMBState, r: &SmbRecord<'b>
             tx.response_done = true;
             SCLogDebug!("tx {} cmd {} is done", tx.id, r.command);
             tx.set_status(r.nt_status, r.is_dos_error);
+            tx.set_events(events);
         }
     }
 }
 
 pub fn smb1_read_response_record<'b>(state: &mut SMBState, r: &SmbRecord<'b>)
 {
-    smb1_read_response_record_generic(state, r);
-
-    if r.nt_status != SMB_NTSTATUS_SUCCESS {
-        return;
-    }
+    let mut events : Vec<SMBEvent> = Vec::new();
 
+    if r.nt_status == SMB_NTSTATUS_SUCCESS {
         match parse_smb_read_andx_response_record(r.data) {
             IResult::Done(_, rd) => {
                 SCLogDebug!("SMBv1: read response => {:?}", rd);
@@ -810,7 +814,11 @@ pub fn smb1_read_response_record<'b>(state: &mut SMBState, r: &SmbRecord<'b>)
                 SCLogDebug!("SMBv1 READ RESPONSE: {} bytes left", state.file_tc_left);
             }
             _ => {
-            state.set_event(SMBEvent::MalformedData);
+                events.push(SMBEvent::MalformedData);
             },
         }
+    }
+
+    // generic tx as well. Set events if needed.
+    smb1_read_response_record_generic(state, r, events);
 }