aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust/clippy: fix lint: single_match

Browse Source 
Allow this lint in some cases where a match statement adds clarity.
pull/8251/head
Jason Ish 4 years ago committed by Victor Julien
parent 925bc74c1f
commit f15ffbc869
32 changed files with 404 additions and 566 deletions
Show Stats Download Patch File Download Diff File

13
rust/src/applayertemplate/template.rs
Unescape Escape View File

@ -197,14 +197,11 @@ impl TemplateState {
Ok((rem, response)) => {
start = rem;
match self.find_request() {
Some(tx) => {
tx.response = Some(response);
SCLogNotice!("Found response for request:");
SCLogNotice!("- Request: {:?}", tx.request);
SCLogNotice!("- Response: {:?}", tx.response);
}
None => {}
if let Some(tx) = self.find_request() {
tx.response = Some(response);
SCLogNotice!("Found response for request:");
SCLogNotice!("- Request: {:?}", tx.request);
SCLogNotice!("- Response: {:?}", tx.response);
}
}
Err(nom::Err::Incomplete(_)) => {

17
rust/src/conf.rs
Unescape Escape View File

@ -79,16 +79,13 @@ pub fn conf_get(key: &str) -> Option<&str> {
// Return the value of key as a boolean. A value that is not set is
// the same as having it set to false.
pub fn conf_get_bool(key: &str) -> bool {
match conf_get(key) {
Some(val) => {
match val {
"1" | "yes" | "true" | "on" => {
return true;
},
_ => {},
}
},
None => {},
if let Some(val) = conf_get(key) {
match val {
"1" | "yes" | "true" | "on" => {
return true;
},
_ => {},
}
}
return false;

3
rust/src/dcerpc/log.rs
Unescape Escape View File

@ -58,6 +58,7 @@ fn log_dcerpc_header_tcp(
if tx.resp_done && !tx.resp_lost {
jsb.set_string("response", &dcerpc_type_string(tx.resp_cmd))?;
#[allow(clippy::single_match)]
match tx.resp_cmd {
DCERPC_TYPE_RESPONSE => {
jsb.open_object("res")?;
@ -85,6 +86,7 @@ fn log_dcerpc_header_udp(
) -> Result<(), JsonError> {
if tx.req_done && !tx.req_lost {
jsb.set_string("request", &dcerpc_type_string(tx.req_cmd))?;
#[allow(clippy::single_match)]
match tx.req_cmd {
DCERPC_TYPE_REQUEST => {
jsb.open_object("req")?;
@ -101,6 +103,7 @@ fn log_dcerpc_header_udp(
if tx.resp_done && !tx.resp_lost {
jsb.set_string("response", &dcerpc_type_string(tx.resp_cmd))?;
#[allow(clippy::single_match)]
match tx.resp_cmd {
DCERPC_TYPE_RESPONSE => {
jsb.open_object("res")?;

2
rust/src/dhcp/logger.rs
Unescape Escape View File

@ -40,8 +40,10 @@ impl DHCPLogger {
let options = &tx.message.options;
for option in options {
let code = option.code;
#[allow(clippy::single_match)]
match &option.option {
&DHCPOptionWrapper::Generic(ref option) => {
#[allow(clippy::single_match)]
match code {
DHCP_OPT_TYPE => {
if !option.data.is_empty() {

21
rust/src/http2/decompression.rs
Unescape Escape View File

@ -200,31 +200,22 @@ impl HTTP2DecoderHalf {
match self.decoder {
HTTP2Decompresser::GZIP(ref mut gzip_decoder) => {
let r = http2_decompress(&mut *gzip_decoder.as_mut(), input, output);
match r {
Err(_) => {
self.decoder = HTTP2Decompresser::UNASSIGNED;
}
_ => {}
if r.is_err() {
self.decoder = HTTP2Decompresser::UNASSIGNED;
}
return r;
}
HTTP2Decompresser::BROTLI(ref mut br_decoder) => {
let r = http2_decompress(&mut *br_decoder.as_mut(), input, output);
match r {
Err(_) => {
self.decoder = HTTP2Decompresser::UNASSIGNED;
}
_ => {}
if r.is_err() {
self.decoder = HTTP2Decompresser::UNASSIGNED;
}
return r;
}
HTTP2Decompresser::DEFLATE(ref mut df_decoder) => {
let r = http2_decompress(&mut *df_decoder.as_mut(), input, output);
match r {
Err(_) => {
self.decoder = HTTP2Decompresser::UNASSIGNED;
}
_ => {}
if r.is_err() {
self.decoder = HTTP2Decompresser::UNASSIGNED;
}
return r;
}

44
rust/src/http2/detect.rs
Unescape Escape View File

@ -190,28 +190,22 @@ fn http2_tx_get_next_window(
let mut pos = 0_u32;
if direction == Direction::ToServer {
for i in 0..tx.frames_ts.len() {
match tx.frames_ts[i].data {
HTTP2FrameTypeData::WINDOWUPDATE(wu) => {
if pos == nb {
return wu.sizeinc as i32;
} else {
pos += 1;
}
if let HTTP2FrameTypeData::WINDOWUPDATE(wu) = tx.frames_ts[i].data {
if pos == nb {
return wu.sizeinc as i32;
} else {
pos += 1;
}
_ => {}
}
}
} else {
for i in 0..tx.frames_tc.len() {
match tx.frames_tc[i].data {
HTTP2FrameTypeData::WINDOWUPDATE(wu) => {
if pos == nb {
return wu.sizeinc as i32;
} else {
pos += 1;
}
if let HTTP2FrameTypeData::WINDOWUPDATE(wu) = tx.frames_tc[i].data {
if pos == nb {
return wu.sizeinc as i32;
} else {
pos += 1;
}
_ => {}
}
}
}
@ -271,24 +265,18 @@ fn http2_detect_settingsctx_match(
) -> std::os::raw::c_int {
if direction == Direction::ToServer {
for i in 0..tx.frames_ts.len() {
match &tx.frames_ts[i].data {
HTTP2FrameTypeData::SETTINGS(set) => {
if http2_detect_settings_match(set, ctx) != 0 {
return 1;
}
if let HTTP2FrameTypeData::SETTINGS(set ) = &tx.frames_ts[i].data {
if http2_detect_settings_match(set, ctx) != 0 {
return 1;
}
_ => {}
}
}
} else {
for i in 0..tx.frames_tc.len() {
match &tx.frames_tc[i].data {
HTTP2FrameTypeData::SETTINGS(set) => {
if http2_detect_settings_match(set, ctx) != 0 {
return 1;
}
if let HTTP2FrameTypeData::SETTINGS(set) = &tx.frames_tc[i].data {
if http2_detect_settings_match(set, ctx) != 0 {
return 1;
}
_ => {}
}
}
}

10
rust/src/http2/http2.rs
Unescape Escape View File

@ -961,17 +961,13 @@ impl HTTP2State {
if padded && !rem.is_empty() && usize::from(rem[0]) < hlsafe{
dinput = &rem[1..hlsafe - usize::from(rem[0])];
}
match tx_same.decompress(
if tx_same.decompress(
dinput,
dir,
sfcm,
over,
flow,
) {
Err(_e) => {
self.set_event(HTTP2Event::FailedDecompression);
}
_ => {}
flow).is_err() {
self.set_event(HTTP2Event::FailedDecompression);
}
}
}

21
rust/src/http2/range.rs
Unescape Escape View File

@ -101,25 +101,16 @@ pub unsafe extern "C" fn rs_http_parse_content_range(
fn http2_range_key_get(tx: &mut HTTP2Transaction) -> Result<(Vec<u8>, usize), ()> {
let hostv = detect::http2_frames_get_header_value_vec(tx, Direction::ToServer, ":authority")?;
let mut hostv = &hostv[..];
match hostv.iter().position(|&x| x == b':') {
Some(p) => {
hostv = &hostv[..p];
}
None => {}
if let Some(p) = hostv.iter().position(|&x| x == b':') {
hostv = &hostv[..p];
}
let uriv = detect::http2_frames_get_header_value_vec(tx, Direction::ToServer, ":path")?;
let mut uriv = &uriv[..];
match uriv.iter().position(|&x| x == b'?') {
Some(p) => {
uriv = &uriv[..p];
}
None => {}
if let Some(p) = uriv.iter().position(|&x| x == b'?') {
uriv = &uriv[..p];
}
match uriv.iter().rposition(|&x| x == b'/') {
Some(p) => {
uriv = &uriv[p..];
}
None => {}
if let Some(p) = uriv.iter().rposition(|&x| x == b'/') {
uriv = &uriv[p..];
}
let mut r = Vec::with_capacity(hostv.len() + uriv.len());
r.extend_from_slice(hostv);

1
rust/src/krb/krb5.rs
Unescape Escape View File

@ -339,6 +339,7 @@ pub unsafe extern "C" fn rs_krb5_probing_parser(_flow: *const Flow,
// Check kerberos version
if let Ok((rem,_hdr)) = der_read_element_header(rem) {
if rem.len() > 5 {
#[allow(clippy::single_match)]
match (rem[2],rem[3],rem[4]) {
// Encoding of DER integer 5 (version)
(2,1,5) => { return alproto; },

1
rust/src/lib.rs
Unescape Escape View File

@ -47,7 +47,6 @@
#![allow(clippy::nonminimal_bool)]
#![allow(clippy::redundant_pattern_matching)]
#![allow(clippy::result_unit_err)]
#![allow(clippy::single_match)]
#![allow(clippy::type_complexity)]
#![allow(clippy::upper_case_acronyms)]

19
rust/src/mime/mod.rs
Unescape Escape View File

@ -138,18 +138,15 @@ pub unsafe extern "C" fn rs_mime_find_header_token(
let hbuf = build_slice!(hinput, hlen as usize);
let tbuf = build_slice!(tinput, tlen as usize);
let mut sections_values = Vec::new();
match mime_find_header_token(hbuf, tbuf, &mut sections_values) {
Ok(value) => {
// limit the copy to the supplied buffer size
if value.len() <= RS_MIME_MAX_TOKEN_LEN {
outbuf[..value.len()].clone_from_slice(value);
} else {
outbuf.clone_from_slice(&value[..RS_MIME_MAX_TOKEN_LEN]);
}
*outlen = value.len() as u32;
return true;
if let Ok(value) = mime_find_header_token(hbuf, tbuf, &mut sections_values) {
// limit the copy to the supplied buffer size
if value.len() <= RS_MIME_MAX_TOKEN_LEN {
outbuf[..value.len()].clone_from_slice(value);
} else {
outbuf.clone_from_slice(&value[..RS_MIME_MAX_TOKEN_LEN]);
}
_ => {}
*outlen = value.len() as u32;
return true;
}
return false;
}

25
rust/src/nfs/nfs.rs
Unescape Escape View File

@ -461,21 +461,18 @@ impl NFSState {
// TODO maybe not enough users to justify a func
pub fn mark_response_tx_done(&mut self, xid: u32, rpc_status: u32, nfs_status: u32, resp_handle: &Vec<u8>)
{
match self.get_tx_by_xid(xid) {
Some(mytx) => {
mytx.response_done = true;
mytx.rpc_response_status = rpc_status;
mytx.nfs_response_status = nfs_status;
if mytx.file_handle.is_empty() && !resp_handle.is_empty() {
mytx.file_handle = resp_handle.to_vec();
}
SCLogDebug!("process_reply_record: tx ID {} XID {:04X} REQUEST {} RESPONSE {}",
if let Some(mytx) = self.get_tx_by_xid(xid) {
mytx.response_done = true;
mytx.rpc_response_status = rpc_status;
mytx.nfs_response_status = nfs_status;
if mytx.file_handle.is_empty() && !resp_handle.is_empty() {
mytx.file_handle = resp_handle.to_vec();
}
SCLogDebug!("process_reply_record: tx ID {} XID {:04X} REQUEST {} RESPONSE {}",
mytx.id, mytx.xid, mytx.request_done, mytx.response_done);
},
None => {
//SCLogNotice!("process_reply_record: not TX found for XID {}", r.hdr.xid);
},
} else {
//SCLogNotice!("process_reply_record: not TX found for XID {}", r.hdr.xid);
}
}

1
rust/src/nfs/nfs2.rs
Unescape Escape View File

@ -74,6 +74,7 @@ impl NFSState {
}
tx.auth_type = r.creds_flavor;
#[allow(clippy::single_match)]
match r.creds {
RpcRequestCreds::Unix(ref u) => {
tx.request_machine_name = u.machine_name_buf.to_vec();

1
rust/src/nfs/nfs3.rs
Unescape Escape View File

@ -152,6 +152,7 @@ impl NFSState {
}
tx.auth_type = r.creds_flavor;
#[allow(clippy::single_match)]
match r.creds {
RpcRequestCreds::Unix(ref u) => {
tx.request_machine_name = u.machine_name_buf.to_vec();

1
rust/src/nfs/nfs4.rs
Unescape Escape View File

@ -140,6 +140,7 @@ impl NFSState {
tx.file_handle = xidmap.file_handle.to_vec();
tx.auth_type = r.creds_flavor;
#[allow(clippy::single_match)]
match r.creds {
RpcRequestCreds::Unix(ref u) => {
tx.request_machine_name = u.machine_name_buf.to_vec();

65
rust/src/quic/frames.rs
Unescape Escape View File

@ -206,35 +206,29 @@ fn quic_tls_ja3_client_extends(ja3: &mut String, exts: Vec<TlsExtension>) {
ja3.push(',');
let mut dash = false;
for e in &exts {
match e {
TlsExtension::EllipticCurves(x) => {
for ec in x {
if dash {
ja3.push('-');
} else {
dash = true;
}
ja3.push_str(&ec.0.to_string());
if let TlsExtension::EllipticCurves(x) = e {
for ec in x {
if dash {
ja3.push('-');
} else {
dash = true;
}
ja3.push_str(&ec.0.to_string());
}
_ => {}
}
}
ja3.push(',');
dash = false;
for e in &exts {
match e {
TlsExtension::EcPointFormats(x) => {
for ec in *x {
if dash {
ja3.push('-');
} else {
dash = true;
}
ja3.push_str(&ec.to_string());
if let TlsExtension::EcPointFormats(x) = e {
for ec in *x {
if dash {
ja3.push('-');
} else {
dash = true;
}
ja3.push_str(&ec.to_string());
}
_ => {}
}
}
}
@ -498,36 +492,27 @@ impl Frame {
let mut crypto_max_size = 0;
let mut crypto_total_size = 0;
for f in &frames {
match f {
Frame::CryptoFrag(c) => {
if crypto_max_size < c.offset + c.length {
crypto_max_size = c.offset + c.length;
}
crypto_total_size += c.length;
if let Frame::CryptoFrag(c) = f {
if crypto_max_size < c.offset + c.length {
crypto_max_size = c.offset + c.length;
}
_ => {}
crypto_total_size += c.length;
}
}
if crypto_max_size > 0 && crypto_total_size == crypto_max_size {
// we have some, and no gaps from offset 0
let mut d = vec![0; crypto_max_size as usize];
for f in &frames {
match f {
Frame::CryptoFrag(c) => {
d[c.offset as usize..(c.offset + c.length) as usize]
.clone_from_slice(&c.data);
}
_ => {}
if let Frame::CryptoFrag(c) = f {
d[c.offset as usize..(c.offset + c.length) as usize]
.clone_from_slice(&c.data);
}
}
match parse_tls_message_handshake(&d) {
Ok((_, msg)) => {
if let Some(c) = parse_quic_handshake(msg) {
// add a parsed crypto frame
frames.push(c);
}
if let Ok((_, msg)) = parse_tls_message_handshake(&d) {
if let Some(c) = parse_quic_handshake(msg) {
// add a parsed crypto frame
frames.push(c);
}
_ => {}
}
}

7
rust/src/rdp/log.rs
Unescape Escape View File

@ -50,11 +50,8 @@ fn log(tx: &RdpTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.set_string("event_type", "tls_handshake")?;
js.open_array("x509_serials")?;
for blob in chain {
match X509Certificate::from_der(&blob.data) {
Ok((_, cert)) => {
js.append_string(&cert.tbs_certificate.serial.to_str_radix(16))?;
}
_ => {}
if let Ok((_, cert)) = X509Certificate::from_der(&blob.data) {
js.append_string(&cert.tbs_certificate.serial.to_str_radix(16))?;
}
}
js.close()?;

3
rust/src/rdp/rdp.rs
Unescape Escape View File

@ -211,6 +211,7 @@ impl RdpState {
// X.223 data packet, evaluate what it encapsulates
T123TpktChild::Data(x223) => {
#[allow(clippy::single_match)]
match x223.child {
X223DataChild::McsConnectRequest(mcs) => {
let tx =
@ -273,6 +274,7 @@ impl RdpState {
// bytes available for futher parsing are what remain
available = remainder;
for message in &tls.msg {
#[allow(clippy::single_match)]
match message {
TlsMessage::Handshake(TlsMessageHandshake::Certificate(
contents,
@ -323,6 +325,7 @@ impl RdpState {
// X.223 data packet, evaluate what it encapsulates
T123TpktChild::Data(x223) => {
#[allow(clippy::single_match)]
match x223.child {
X223DataChild::McsConnectResponse(mcs) => {
let tx = self

1
rust/src/rfb/logger.rs
Unescape Escape View File

@ -44,6 +44,7 @@ fn log_rfb(tx: &RFBTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
if let Some(chosen_security_type) = tx.chosen_security_type {
js.set_uint("security_type", chosen_security_type as u64)?;
}
#[allow(clippy::single_match)]
match tx.chosen_security_type {
Some(2) => {
js.open_object("vnc")?;

65
rust/src/smb/auth.rs
Unescape Escape View File

@ -124,11 +124,8 @@ fn parse_secblob_spnego(blob: &[u8]) -> Option<SpnegoRequest>
},
BerObjectContent::OctetString(os) => {
if have_kerberos {
match parse_kerberos5_request(os) {
Ok((_, t)) => {
kticket = Some(t)
},
_ => { },
if let Ok((_, t)) = parse_kerberos5_request(os) {
kticket = Some(t)
}
}
@ -162,39 +159,33 @@ fn parse_ntlmssp_blob(blob: &[u8]) -> Option<NtlmsspData>
let mut ntlmssp_data : Option<NtlmsspData> = None;
SCLogDebug!("NTLMSSP {:?}", blob);
match parse_ntlmssp(blob) {
Ok((_, nd)) => {
SCLogDebug!("NTLMSSP TYPE {}/{} nd {:?}",
if let Ok((_, nd)) = parse_ntlmssp(blob) {
SCLogDebug!("NTLMSSP TYPE {}/{} nd {:?}",
nd.msg_type, &ntlmssp_type_string(nd.msg_type), nd);
match nd.msg_type {
NTLMSSP_NEGOTIATE => {
},
NTLMSSP_AUTH => {
match parse_ntlm_auth_record(nd.data) {
Ok((_, ad)) => {
SCLogDebug!("auth data {:?}", ad);
let mut host = ad.host.to_vec();
host.retain(|&i|i != 0x00);
let mut user = ad.user.to_vec();
user.retain(|&i|i != 0x00);
let mut domain = ad.domain.to_vec();
domain.retain(|&i|i != 0x00);
let d = NtlmsspData {
host,
user,
domain,
version: ad.version,
};
ntlmssp_data = Some(d);
},
_ => {},
}
},
_ => {},
}
},
_ => {},
match nd.msg_type {
NTLMSSP_NEGOTIATE => {
},
NTLMSSP_AUTH => {
if let Ok((_, ad)) = parse_ntlm_auth_record(nd.data) {
SCLogDebug!("auth data {:?}", ad);
let mut host = ad.host.to_vec();
host.retain(|&i|i != 0x00);
let mut user = ad.user.to_vec();
user.retain(|&i|i != 0x00);
let mut domain = ad.domain.to_vec();
domain.retain(|&i|i != 0x00);
let d = NtlmsspData {
host,
user,
domain,
version: ad.version,
};
ntlmssp_data = Some(d);
}
},
_ => {},
}
}
return ntlmssp_data;
}

23
rust/src/smb/dcerpc.rs
Unescape Escape View File

@ -346,20 +346,17 @@ fn smb_dcerpc_response_bindack(
None => false,
};
if found {
match state.dcerpc_ifaces {
Some(ref mut ifaces) => {
let mut i = 0;
for r in bindackr.results {
if i >= ifaces.len() {
// TODO set event: more acks that requests
break;
}
ifaces[i].ack_result = r.ack_result;
ifaces[i].acked = true;
i += 1;
if let Some(ref mut ifaces) = state.dcerpc_ifaces {
let mut i = 0;
for r in bindackr.results {
if i >= ifaces.len() {
// TODO set event: more acks that requests
break;
}
},
_ => {},
ifaces[i].ack_result = r.ack_result;
ifaces[i].acked = true;
i += 1;
}
}
}
},

102
rust/src/smb/detect.rs
Unescape Escape View File

@ -28,16 +28,12 @@ pub unsafe extern "C" fn rs_smb_tx_get_share(tx: &mut SMBTransaction,
buffer_len: *mut u32)
-> u8
{
match tx.type_data {
Some(SMBTransactionTypeData::TREECONNECT(ref x)) => {
SCLogDebug!("is_pipe {}", x.is_pipe);
if !x.is_pipe {
*buffer = x.share_name.as_ptr();
*buffer_len = x.share_name.len() as u32;
return 1;
}
}
_ => {
if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
SCLogDebug!("is_pipe {}", x.is_pipe);
if !x.is_pipe {
*buffer = x.share_name.as_ptr();
*buffer_len = x.share_name.len() as u32;
return 1;
}
}
@ -52,16 +48,12 @@ pub unsafe extern "C" fn rs_smb_tx_get_named_pipe(tx: &mut SMBTransaction,
buffer_len: *mut u32)
-> u8
{
match tx.type_data {
Some(SMBTransactionTypeData::TREECONNECT(ref x)) => {
SCLogDebug!("is_pipe {}", x.is_pipe);
if x.is_pipe {
*buffer = x.share_name.as_ptr();
*buffer_len = x.share_name.len() as u32;
return 1;
}
}
_ => {
if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
SCLogDebug!("is_pipe {}", x.is_pipe);
if x.is_pipe {
*buffer = x.share_name.as_ptr();
*buffer_len = x.share_name.len() as u32;
return 1;
}
}
@ -77,20 +69,16 @@ pub unsafe extern "C" fn rs_smb_tx_get_stub_data(tx: &mut SMBTransaction,
buffer_len: *mut u32)
-> u8
{
match tx.type_data {
Some(SMBTransactionTypeData::DCERPC(ref x)) => {
let vref = if direction == Direction::ToServer as u8 {
&x.stub_data_ts
} else {
&x.stub_data_tc
};
if !vref.is_empty() {
*buffer = vref.as_ptr();
*buffer_len = vref.len() as u32;
return 1;
}
}
_ => {
if let Some(SMBTransactionTypeData::DCERPC(ref x)) = tx.type_data {
let vref = if direction == Direction::ToServer as u8 {
&x.stub_data_ts
} else {
&x.stub_data_tc
};
if !vref.is_empty() {
*buffer = vref.as_ptr();
*buffer_len = vref.len() as u32;
return 1;
}
}
@ -105,22 +93,18 @@ pub extern "C" fn rs_smb_tx_match_dce_opnum(tx: &mut SMBTransaction,
-> u8
{
SCLogDebug!("rs_smb_tx_get_dce_opnum: start");
match tx.type_data {
Some(SMBTransactionTypeData::DCERPC(ref x)) => {
if x.req_cmd == DCERPC_TYPE_REQUEST {
for range in dce_data.data.iter() {
if range.range2 == DETECT_DCE_OPNUM_RANGE_UNINITIALIZED {
if range.range1 == x.opnum as u32 {
return 1;
}
} else if range.range1 <= x.opnum as u32 && range.range2 >= x.opnum as u32 {
if let Some(SMBTransactionTypeData::DCERPC(ref x)) = tx.type_data {
if x.req_cmd == DCERPC_TYPE_REQUEST {
for range in dce_data.data.iter() {
if range.range2 == DETECT_DCE_OPNUM_RANGE_UNINITIALIZED {
if range.range1 == x.opnum as u32 {
return 1;
}
} else if range.range1 <= x.opnum as u32 && range.range2 >= x.opnum as u32 {
return 1;
}
}
}
_ => {
}
}
return 0;
@ -177,15 +161,11 @@ pub unsafe extern "C" fn rs_smb_tx_get_ntlmssp_user(tx: &mut SMBTransaction,
buffer_len: *mut u32)
-> u8
{
match tx.type_data {
Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) => {
if let Some(ref ntlmssp) = x.ntlmssp {
*buffer = ntlmssp.user.as_ptr();
*buffer_len = ntlmssp.user.len() as u32;
return 1;
}
}
_ => {
if let Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) = tx.type_data {
if let Some(ref ntlmssp) = x.ntlmssp {
*buffer = ntlmssp.user.as_ptr();
*buffer_len = ntlmssp.user.len() as u32;
return 1;
}
}
@ -200,15 +180,11 @@ pub unsafe extern "C" fn rs_smb_tx_get_ntlmssp_domain(tx: &mut SMBTransaction,
buffer_len: *mut u32)
-> u8
{
match tx.type_data {
Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) => {
if let Some(ref ntlmssp) = x.ntlmssp {
*buffer = ntlmssp.domain.as_ptr();
*buffer_len = ntlmssp.domain.len() as u32;
return 1;
}
}
_ => {
if let Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) = tx.type_data {
if let Some(ref ntlmssp) = x.ntlmssp {
*buffer = ntlmssp.domain.as_ptr();
*buffer_len = ntlmssp.domain.len() as u32;
return 1;
}
}

17
rust/src/smb/files.rs
Unescape Escape View File

@ -69,16 +69,13 @@ impl SMBState {
{
let mut tx = self.new_tx();
tx.type_data = Some(SMBTransactionTypeData::FILE(SMBTransactionFile::new()));
match tx.type_data {
Some(SMBTransactionTypeData::FILE(ref mut d)) => {
d.direction = direction;
d.fuid = fuid.to_vec();
d.file_name = file_name.to_vec();
d.file_tracker.tx_id = tx.id - 1;
tx.tx_data.update_file_flags(self.state_data.file_flags);
d.update_file_flags(tx.tx_data.file_flags);
},
_ => { },
if let Some(SMBTransactionTypeData::FILE(ref mut d)) = tx.type_data {
d.direction = direction;
d.fuid = fuid.to_vec();
d.file_name = file_name.to_vec();
d.file_tracker.tx_id = tx.id - 1;
tx.tx_data.update_file_flags(self.state_data.file_flags);
d.update_file_flags(tx.tx_data.file_flags);
}
tx.tx_data.init_files_opened();
tx.tx_data.file_tx = if direction == Direction::ToServer { STREAM_TOSERVER } else { STREAM_TOCLIENT }; // TODO direction to flag func?

91
rust/src/smb/log.rs
Unescape Escape View File

@ -110,6 +110,7 @@ fn smb_common_header(jsb: &mut JsonBuilder, state: &SMBState, tx: &SMBTransactio
jsb.set_string("status_code", &status_hex)?;
},
(false, _) => {
#[allow(clippy::single_match)]
match tx.vercmd.get_dos_error() {
(true, errclass, errcode) => {
match errclass {
@ -172,27 +173,21 @@ fn smb_common_header(jsb: &mut JsonBuilder, state: &SMBState, tx: &SMBTransactio
jsb.close()?;
}
match x.request_host {
Some(ref r) => {
jsb.open_object("request")?;
let os = String::from_utf8_lossy(&r.native_os);
jsb.set_string("native_os", &os)?;
let lm = String::from_utf8_lossy(&r.native_lm);
jsb.set_string("native_lm", &lm)?;
jsb.close()?;
},
None => { },
if let Some(ref r) = x.request_host {
jsb.open_object("request")?;
let os = String::from_utf8_lossy(&r.native_os);
jsb.set_string("native_os", &os)?;
let lm = String::from_utf8_lossy(&r.native_lm);
jsb.set_string("native_lm", &lm)?;
jsb.close()?;
}
match x.response_host {
Some(ref r) => {
jsb.open_object("response")?;
let os = String::from_utf8_lossy(&r.native_os);
jsb.set_string("native_os", &os)?;
let lm = String::from_utf8_lossy(&r.native_lm);
jsb.set_string("native_lm", &lm)?;
jsb.close()?;
},
None => { },
if let Some(ref r) = x.response_host {
jsb.open_object("response")?;
let os = String::from_utf8_lossy(&r.native_os);
jsb.set_string("native_os", &os)?;
let lm = String::from_utf8_lossy(&r.native_lm);
jsb.set_string("native_lm", &lm)?;
jsb.close()?;
}
},
Some(SMBTransactionTypeData::CREATE(ref x)) => {
@ -343,50 +338,45 @@ fn smb_common_header(jsb: &mut JsonBuilder, state: &SMBState, tx: &SMBTransactio
jsb.set_uint("frag_cnt", x.frag_cnt_ts as u64)?;
jsb.set_uint("stub_data_size", x.stub_data_ts.len() as u64)?;
jsb.close()?;
match state.dcerpc_ifaces {
Some(ref ifaces) => {
for i in ifaces {
if i.context_id == x.context_id {
jsb.open_object("interface")?;
let ifstr = uuid::Uuid::from_slice(&i.uuid);
let ifstr = ifstr.map(|ifstr| ifstr.to_hyphenated().to_string()).unwrap();
jsb.set_string("uuid", &ifstr)?;
let vstr = format!("{}.{}", i.ver, i.ver_min);
jsb.set_string("version", &vstr)?;
jsb.close()?;
}
}
},
_ => {},
}
},
DCERPC_TYPE_BIND => {
match state.dcerpc_ifaces {
Some(ref ifaces) => {
jsb.open_array("interfaces")?;
for i in ifaces {
jsb.start_object()?;
if let Some(ref ifaces) = state.dcerpc_ifaces {
for i in ifaces {
if i.context_id == x.context_id {
jsb.open_object("interface")?;
let ifstr = uuid::Uuid::from_slice(&i.uuid);
let ifstr = ifstr.map(|ifstr| ifstr.to_hyphenated().to_string()).unwrap();
jsb.set_string("uuid", &ifstr)?;
let vstr = format!("{}.{}", i.ver, i.ver_min);
jsb.set_string("version", &vstr)?;
if i.acked {
jsb.set_uint("ack_result", i.ack_result as u64)?;
jsb.set_uint("ack_reason", i.ack_reason as u64)?;
}
jsb.close()?;
}
}
}
},
DCERPC_TYPE_BIND => {
if let Some(ref ifaces) = state.dcerpc_ifaces {
jsb.open_array("interfaces")?;
for i in ifaces {
jsb.start_object()?;
let ifstr = uuid::Uuid::from_slice(&i.uuid);
let ifstr = ifstr.map(|ifstr| ifstr.to_hyphenated().to_string()).unwrap();
jsb.set_string("uuid", &ifstr)?;
let vstr = format!("{}.{}", i.ver, i.ver_min);
jsb.set_string("version", &vstr)?;
if i.acked {
jsb.set_uint("ack_result", i.ack_result as u64)?;
jsb.set_uint("ack_reason", i.ack_reason as u64)?;
}
jsb.close()?;
},
_ => {},
}
jsb.close()?;
}
},
_ => {},
}
}
if x.res_set {
#[allow(clippy::single_match)]
match x.res_cmd {
DCERPC_TYPE_RESPONSE => {
jsb.open_object("res")?;
@ -430,6 +420,7 @@ fn smb_common_header(jsb: &mut JsonBuilder, state: &SMBState, tx: &SMBTransactio
_ => { },
}
#[allow(clippy::single_match)]
match x.loi {
1013 => { // Set Disposition Information
jsb.set_string("level_of_interest", "Set Disposition Information")?;

250
rust/src/smb/smb.rs
Unescape Escape View File

@ -878,26 +878,23 @@ impl SMBState {
-> Option<&mut SMBTransaction>
{
let tx_ref = self.transactions.last_mut();
match tx_ref {
Some(tx) => {
let found = if tx.vercmd.get_version() == smb_ver {
if smb_ver == 1 {
let (_, cmd) = tx.vercmd.get_smb1_cmd();
cmd as u16 == smb_cmd
} else if smb_ver == 2 {
let (_, cmd) = tx.vercmd.get_smb2_cmd();
cmd == smb_cmd
} else {
false
}
if let Some(tx) = tx_ref {
let found = if tx.vercmd.get_version() == smb_ver {
if smb_ver == 1 {
let (_, cmd) = tx.vercmd.get_smb1_cmd();
cmd as u16 == smb_cmd
} else if smb_ver == 2 {
let (_, cmd) = tx.vercmd.get_smb2_cmd();
cmd == smb_cmd
} else {
false
};
if found {
return Some(tx);
}
},
None => { },
} else {
false
};
if found {
return Some(tx);
}
}
return None;
}
@ -1251,84 +1248,68 @@ impl SMBState {
// 'NBSS continuation data'. If it's invalid we're
// lost so we give up.
if input.len() > 8 {
match parse_nbss_record_partial(input) {
Ok((_, ref hdr)) => {
if !hdr.is_smb() {
SCLogDebug!("partial NBSS, not SMB and no known msg type {}", hdr.message_type);
self.trunc_ts();
return 0;
}
},
_ => {},
if let Ok((_, ref hdr)) = parse_nbss_record_partial(input) {
if !hdr.is_smb() {
SCLogDebug!("partial NBSS, not SMB and no known msg type {}", hdr.message_type);
self.trunc_ts();
return 0;
}
}
}
return 0;
}
match parse_nbss_record_partial(input) {
Ok((output, ref nbss_part_hdr)) => {
SCLogDebug!("parse_nbss_record_partial ok, output len {}", output.len());
if nbss_part_hdr.message_type == NBSS_MSGTYPE_SESSION_MESSAGE {
match parse_smb_version(nbss_part_hdr.data) {
Ok((_, ref smb)) => {
SCLogDebug!("SMB {:?}", smb);
if smb.version == 0xff_u8 { // SMB1
SCLogDebug!("SMBv1 record");
match parse_smb_record(nbss_part_hdr.data) {
Ok((_, ref r)) => {
if r.command == SMB1_COMMAND_WRITE_ANDX {
// see if it's a write to a pipe. We only handle those
// if complete.
let tree_key = SMBCommonHdr::new(SMBHDR_TYPE_SHARE,
r.ssn_id as u64, r.tree_id as u32, 0);
let is_pipe = match self.ssn2tree_map.get(&tree_key) {
Some(n) => n.is_pipe,
None => false,
};
if is_pipe {
return 0;
}
smb1_write_request_record(self, r, SMB1_HEADER_SIZE, SMB1_COMMAND_WRITE_ANDX);
self.add_nbss_ts_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
self.add_smb1_ts_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
self.add_smb1_ts_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
let consumed = input.len() - output.len();
return consumed;
}
},
_ => { },
}
} else if smb.version == 0xfe_u8 { // SMB2
SCLogDebug!("SMBv2 record");
match parse_smb2_request_record(nbss_part_hdr.data) {
Ok((_, ref smb_record)) => {
SCLogDebug!("SMB2: partial record {}",
&smb2_command_string(smb_record.command));
if smb_record.command == SMB2_COMMAND_WRITE {
smb2_write_request_record(self, smb_record);
self.add_nbss_ts_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
self.add_smb2_ts_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
self.add_smb2_ts_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64, smb_record.header_len as i64);
let consumed = input.len() - output.len();
SCLogDebug!("consumed {}", consumed);
return consumed;
}
},
_ => { },
if let Ok((output, ref nbss_part_hdr)) = parse_nbss_record_partial(input) {
SCLogDebug!("parse_nbss_record_partial ok, output len {}", output.len());
if nbss_part_hdr.message_type == NBSS_MSGTYPE_SESSION_MESSAGE {
if let Ok((_, ref smb)) = parse_smb_version(nbss_part_hdr.data) {
SCLogDebug!("SMB {:?}", smb);
if smb.version == 0xff_u8 { // SMB1
SCLogDebug!("SMBv1 record");
if let Ok((_, ref r)) = parse_smb_record(nbss_part_hdr.data) {
if r.command == SMB1_COMMAND_WRITE_ANDX {
// see if it's a write to a pipe. We only handle those
// if complete.
let tree_key = SMBCommonHdr::new(SMBHDR_TYPE_SHARE,
r.ssn_id as u64, r.tree_id as u32, 0);
let is_pipe = match self.ssn2tree_map.get(&tree_key) {
Some(n) => n.is_pipe,
None => false,
};
if is_pipe {
return 0;
}
smb1_write_request_record(self, r, SMB1_HEADER_SIZE, SMB1_COMMAND_WRITE_ANDX);
self.add_nbss_ts_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
self.add_smb1_ts_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
self.add_smb1_ts_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
let consumed = input.len() - output.len();
return consumed;
}
}
} else if smb.version == 0xfe_u8 { // SMB2
SCLogDebug!("SMBv2 record");
if let Ok((_, ref smb_record)) = parse_smb2_request_record(nbss_part_hdr.data) {
SCLogDebug!("SMB2: partial record {}",
&smb2_command_string(smb_record.command));
if smb_record.command == SMB2_COMMAND_WRITE {
smb2_write_request_record(self, smb_record);
self.add_nbss_ts_frames(flow, stream_slice, input, nbss_part_hdr.length as i64);
self.add_smb2_ts_pdu_frame(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64);
self.add_smb2_ts_hdr_data_frames(flow, stream_slice, nbss_part_hdr.data, nbss_part_hdr.length as i64, smb_record.header_len as i64);
let consumed = input.len() - output.len();
SCLogDebug!("consumed {}", consumed);
return consumed;
}
// no SMB3 here yet, will buffer full records
},
_ => { },
}
}
// no SMB3 here yet, will buffer full records
}
},
_ => { },
}
}
return 0;
@ -1595,15 +1576,12 @@ impl SMBState {
// 'NBSS continuation data'. If it's invalid we're
// lost so we give up.
if input.len() > 8 {
match parse_nbss_record_partial(input) {
Ok((_, ref hdr)) => {
if !hdr.is_smb() {
SCLogDebug!("partial NBSS, not SMB and no known msg type {}", hdr.message_type);
self.trunc_tc();
return 0;
}
},
_ => {},
if let Ok((_, ref hdr)) = parse_nbss_record_partial(input) {
if !hdr.is_smb() {
SCLogDebug!("partial NBSS, not SMB and no known msg type {}", hdr.message_type);
self.trunc_tc();
return 0;
}
}
}
return 0;
@ -2031,40 +2009,34 @@ fn smb_probe_tcp_midstream(direction: Direction, slice: &[u8], rdir: *mut u8, be
SCLogDebug!("SMB {:?}", smb);
if smb.version == 0xff_u8 { // SMB1
SCLogDebug!("SMBv1 record");
match parse_smb_record(data) {
Ok((_, ref smb_record)) => {
if smb_record.flags & 0x80 != 0 {
SCLogDebug!("RESPONSE {:02x}", smb_record.flags);
if direction == Direction::ToServer {
unsafe { *rdir = Direction::ToClient as u8; }
}
} else {
SCLogDebug!("REQUEST {:02x}", smb_record.flags);
if direction == Direction::ToClient {
unsafe { *rdir = Direction::ToServer as u8; }
}
if let Ok((_, ref smb_record)) = parse_smb_record(data) {
if smb_record.flags & 0x80 != 0 {
SCLogDebug!("RESPONSE {:02x}", smb_record.flags);
if direction == Direction::ToServer {
unsafe { *rdir = Direction::ToClient as u8; }
}
return 1;
},
_ => { },
} else {
SCLogDebug!("REQUEST {:02x}", smb_record.flags);
if direction == Direction::ToClient {
unsafe { *rdir = Direction::ToServer as u8; }
}
}
return 1;
}
} else if smb.version == 0xfe_u8 { // SMB2
SCLogDebug!("SMB2 record");
match parse_smb2_record_direction(data) {
Ok((_, ref smb_record)) => {
if direction == Direction::ToServer {
SCLogDebug!("direction Direction::ToServer smb_record {:?}", smb_record);
if !smb_record.request {
unsafe { *rdir = Direction::ToClient as u8; }
}
} else {
SCLogDebug!("direction Direction::ToClient smb_record {:?}", smb_record);
if smb_record.request {
unsafe { *rdir = Direction::ToServer as u8; }
}
if let Ok((_, ref smb_record)) = parse_smb2_record_direction(data) {
if direction == Direction::ToServer {
SCLogDebug!("direction Direction::ToServer smb_record {:?}", smb_record);
if !smb_record.request {
unsafe { *rdir = Direction::ToClient as u8; }
}
},
_ => {},
} else {
SCLogDebug!("direction Direction::ToClient smb_record {:?}", smb_record);
if smb_record.request {
unsafe { *rdir = Direction::ToServer as u8; }
}
}
}
}
else if smb.version == 0xfd_u8 { // SMB3 transform
@ -2089,27 +2061,23 @@ fn smb_probe_tcp(flags: u8, slice: &[u8], rdir: *mut u8, begins: bool) -> AppPro
if flags & STREAM_MIDSTREAM == STREAM_MIDSTREAM && smb_probe_tcp_midstream(flags.into(), slice, rdir, begins) == 1 {
unsafe { return ALPROTO_SMB; }
}
match parse_nbss_record_partial(slice) {
Ok((_, ref hdr)) => {
if hdr.is_smb() {
SCLogDebug!("smb found");
unsafe { return ALPROTO_SMB; }
} else if hdr.needs_more(){
return 0;
} else if hdr.is_valid() &&
hdr.message_type != NBSS_MSGTYPE_SESSION_MESSAGE {
if let Ok((_, ref hdr)) = parse_nbss_record_partial(slice) {
if hdr.is_smb() {
SCLogDebug!("smb found");
unsafe { return ALPROTO_SMB; }
} else if hdr.needs_more(){
return 0;
} else if hdr.is_valid() &&
hdr.message_type != NBSS_MSGTYPE_SESSION_MESSAGE {
//we accept a first small netbios message before real SMB
let hl = hdr.length as usize;
if hdr.data.len() >= hl + 8 {
// 8 is 4 bytes NBSS + 4 bytes SMB0xFX magic
match parse_nbss_record_partial(&hdr.data[hl..]) {
Ok((_, ref hdr2)) => {
if hdr2.is_smb() {
SCLogDebug!("smb found");
unsafe { return ALPROTO_SMB; }
}
if let Ok((_, ref hdr2)) = parse_nbss_record_partial(&hdr.data[hl..]) {
if hdr2.is_smb() {
SCLogDebug!("smb found");
unsafe { return ALPROTO_SMB; }
}
_ => {}
}
} else if hdr.length < 256 {
// we want more data, 256 is some random value
@ -2117,8 +2085,6 @@ fn smb_probe_tcp(flags: u8, slice: &[u8], rdir: *mut u8, begins: bool) -> AppPro
}
// default is failure
}
},
_ => { },
}
SCLogDebug!("no smb");
unsafe { return ALPROTO_FAILED; }

51
rust/src/smb/smb1.rs
Unescape Escape View File

@ -666,16 +666,13 @@ fn smb1_response_record_one<'b>(state: &mut SMBState, r: &SmbRecord<'b>, command
SMB1_COMMAND_TREE_CONNECT_ANDX => {
if r.nt_status != SMB_NTSTATUS_SUCCESS {
let name_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_TREE);
match state.get_treeconnect_tx(name_key) {
Some(tx) => {
if let Some(SMBTransactionTypeData::TREECONNECT(ref mut tdn)) = tx.type_data {
tdn.tree_id = r.tree_id as u32;
}
tx.set_status(r.nt_status, r.is_dos_error);
tx.response_done = true;
SCLogDebug!("tx {} is done", tx.id);
},
None => { },
if let Some(tx) = state.get_treeconnect_tx(name_key) {
if let Some(SMBTransactionTypeData::TREECONNECT(ref mut tdn)) = tx.type_data {
tdn.tree_id = r.tree_id as u32;
}
tx.set_status(r.nt_status, r.is_dos_error);
tx.response_done = true;
SCLogDebug!("tx {} is done", tx.id);
}
return;
}
@ -797,15 +794,12 @@ fn smb1_response_record_one<'b>(state: &mut SMBState, r: &SmbRecord<'b>, command
};
if !have_tx && tx_sync {
match state.get_last_tx(1, command as u16) {
Some(tx) => {
SCLogDebug!("last TX {} is CMD {}", tx.id, &smb1_command_string(command));
tx.response_done = true;
SCLogDebug!("tx {} cmd {} is done", tx.id, command);
tx.set_status(r.nt_status, r.is_dos_error);
tx.set_events(events);
},
_ => {},
if let Some(tx) = state.get_last_tx(1, command as u16) {
SCLogDebug!("last TX {} is CMD {}", tx.id, &smb1_command_string(command));
tx.response_done = true;
SCLogDebug!("tx {} cmd {} is done", tx.id, command);
tx.set_status(r.nt_status, r.is_dos_error);
tx.set_events(events);
}
} else if !have_tx && smb1_check_tx(command) {
let tx_key = SMBCommonHdr::new(SMBHDR_TYPE_GENERICTX,
@ -819,7 +813,7 @@ fn smb1_response_record_one<'b>(state: &mut SMBState, r: &SmbRecord<'b>, command
tx.set_events(events);
true
},
_ => {
None => {
SCLogDebug!("no TX found for key {:?}", tx_key);
false
},
@ -1136,16 +1130,13 @@ fn smb1_request_record_generic<'b>(state: &mut SMBState, r: &SmbRecord<'b>, even
/// if we didn't already update a tx, and we have to set events
fn smb1_response_record_generic<'b>(state: &mut SMBState, r: &SmbRecord<'b>, events: Vec<SMBEvent>) {
let tx_key = SMBCommonHdr::from1(r, SMBHDR_TYPE_GENERICTX);
match state.get_generic_tx(1, r.command as u16, &tx_key) {
Some(tx) => {
tx.request_done = true;
tx.response_done = true;
SCLogDebug!("tx {} cmd {} is done", tx.id, r.command);
tx.set_status(r.nt_status, r.is_dos_error);
tx.set_events(events);
return;
},
None => {},
if let Some(tx) = state.get_generic_tx(1, r.command as u16, &tx_key) {
tx.request_done = true;
tx.response_done = true;
SCLogDebug!("tx {} cmd {} is done", tx.id, r.command);
tx.set_status(r.nt_status, r.is_dos_error);
tx.set_events(events);
return;
}
if !events.is_empty() {
let tx = state.new_generic_tx(1, r.command as u16, tx_key);

10
rust/src/smb/smb1_session.rs
Unescape Escape View File

@ -126,6 +126,7 @@ pub fn smb1_session_setup_response_host_info(r: &SmbRecord, blob: &[u8]) -> Sess
pub fn smb1_session_setup_request(state: &mut SMBState, r: &SmbRecord, andx_offset: usize)
{
SCLogDebug!("SMB1_COMMAND_SESSION_SETUP_ANDX user_id {}", r.user_id);
#[allow(clippy::single_match)]
match parse_smb_setup_andx_record(&r.data[andx_offset-SMB1_HEADER_SIZE..]) {
Ok((rem, setup)) => {
let hdr = SMBCommonHdr::new(SMBHDR_TYPE_HEADER,
@ -134,12 +135,9 @@ pub fn smb1_session_setup_request(state: &mut SMBState, r: &SmbRecord, andx_offs
tx.vercmd.set_smb1_cmd(r.command);
if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
match parse_secblob(setup.sec_blob) {
Some(s) => {
td.ntlmssp = s.ntlmssp;
td.krb_ticket = s.krb;
},
None => { },
if let Some(s) = parse_secblob(setup.sec_blob) {
td.ntlmssp = s.ntlmssp;
td.krb_ticket = s.krb;
}
td.request_host = Some(smb1_session_setup_request_host_info(r, rem));
}

40
rust/src/smb/smb2_ioctl.rs
Unescape Escape View File

@ -105,34 +105,28 @@ pub fn smb2_ioctl_response_record<'b>(state: &mut SMBState, r: &Smb2Record<'b>)
smb_read_dcerpc_record(state, vercmd, hdr, &[],rd.data);
} else {
SCLogDebug!("SMB2_COMMAND_IOCTL/SMB_NTSTATUS_PENDING looking for {:?}", hdr);
match state.get_generic_tx(2, SMB2_COMMAND_IOCTL, &hdr) {
Some(tx) => {
tx.set_status(r.nt_status, false);
if r.nt_status != SMB_NTSTATUS_PENDING {
tx.response_done = true;
}
},
None => { },
if let Some(tx) = state.get_generic_tx(2, SMB2_COMMAND_IOCTL, &hdr) {
tx.set_status(r.nt_status, false);
if r.nt_status != SMB_NTSTATUS_PENDING {
tx.response_done = true;
}
}
}
},
_ => {
SCLogDebug!("SMB2_COMMAND_IOCTL/SMB_NTSTATUS_PENDING looking for {:?}", hdr);
match state.get_generic_tx(2, SMB2_COMMAND_IOCTL, &hdr) {
Some(tx) => {
SCLogDebug!("updated status of tx {}", tx.id);
tx.set_status(r.nt_status, false);
if r.nt_status != SMB_NTSTATUS_PENDING {
tx.response_done = true;
}
// parsing failed for 'SUCCESS' record, set event
if r.nt_status == SMB_NTSTATUS_SUCCESS {
SCLogDebug!("parse fail {:?}", r);
tx.set_event(SMBEvent::MalformedData);
}
},
_ => { },
if let Some(tx) = state.get_generic_tx(2, SMB2_COMMAND_IOCTL, &hdr) {
SCLogDebug!("updated status of tx {}", tx.id);
tx.set_status(r.nt_status, false);
if r.nt_status != SMB_NTSTATUS_PENDING {
tx.response_done = true;
}
// parsing failed for 'SUCCESS' record, set event
if r.nt_status == SMB_NTSTATUS_SUCCESS {
SCLogDebug!("parse fail {:?}", r);
tx.set_event(SMBEvent::MalformedData);
}
}
},
};

1
rust/src/smb/smb2_session.rs
Unescape Escape View File

@ -23,6 +23,7 @@ use crate::smb::auth::*;
pub fn smb2_session_setup_request(state: &mut SMBState, r: &Smb2Record)
{
SCLogDebug!("SMB2_COMMAND_SESSION_SETUP: r.data.len() {}", r.data.len());
#[allow(clippy::single_match)]
match parse_smb2_request_session_setup(r.data) {
Ok((_, setup)) => {
let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);

18
rust/src/snmp/detect.rs
Unescape Escape View File

@ -29,12 +29,9 @@ pub unsafe extern "C" fn rs_snmp_tx_get_version(tx: &mut SNMPTransaction, versio
pub unsafe extern "C" fn rs_snmp_tx_get_community(
tx: &mut SNMPTransaction, buf: *mut *const u8, len: *mut u32,
) {
match tx.community {
Some(ref c) => {
*buf = c.as_ptr();
*len = c.len() as u32;
}
None => (),
if let Some(ref c) = tx.community {
*buf = c.as_ptr();
*len = c.len() as u32;
}
}
@ -54,11 +51,8 @@ pub unsafe extern "C" fn rs_snmp_tx_get_pdu_type(tx: &mut SNMPTransaction, pdu_t
pub unsafe extern "C" fn rs_snmp_tx_get_usm(
tx: &mut SNMPTransaction, buf: *mut *const u8, len: *mut u32,
) {
match tx.usm {
Some(ref c) => {
*buf = c.as_ptr();
*len = c.len() as u32;
}
None => (),
if let Some(ref c) = tx.usm {
*buf = c.as_ptr();
*len = c.len() as u32;
}
}

40
rust/src/snmp/log.rs
Unescape Escape View File

@ -43,31 +43,25 @@ fn snmp_log_response(jsb: &mut JsonBuilder, state: &mut SNMPState, tx: &mut SNMP
if tx.encrypted {
jsb.set_string("pdu_type", "encrypted")?;
} else {
match tx.info {
Some(ref info) => {
jsb.set_string("pdu_type", &str_of_pdu_type(&info.pdu_type))?;
if info.err.0 != 0 {
jsb.set_string("error", &format!("{:?}", info.err))?;
if let Some(ref info) = tx.info {
jsb.set_string("pdu_type", &str_of_pdu_type(&info.pdu_type))?;
if info.err.0 != 0 {
jsb.set_string("error", &format!("{:?}", info.err))?;
}
if let Some((trap_type, ref oid, address)) = info.trap_type {
jsb.set_string("trap_type", &format!("{:?}", trap_type))?;
jsb.set_string("trap_oid", &oid.to_string())?;
match address {
NetworkAddress::IPv4(ip) => {jsb.set_string("trap_address", &ip.to_string())?;},
}
match info.trap_type {
Some((trap_type, ref oid, address)) => {
jsb.set_string("trap_type", &format!("{:?}", trap_type))?;
jsb.set_string("trap_oid", &oid.to_string())?;
match address {
NetworkAddress::IPv4(ip) => {jsb.set_string("trap_address", &ip.to_string())?;},
}
},
_ => ()
}
if !info.vars.is_empty() {
jsb.open_array("vars")?;
for var in info.vars.iter() {
jsb.append_string(&var.to_string())?;
}
if !info.vars.is_empty() {
jsb.open_array("vars")?;
for var in info.vars.iter() {
jsb.append_string(&var.to_string())?;
}
jsb.close()?;
}
},
_ => ()
jsb.close()?;
}
}
if let Some(community) = &tx.community {
jsb.set_string("community", community)?;

6
rust/src/snmp/snmp.rs
Unescape Escape View File

@ -184,9 +184,8 @@ impl<'a> SNMPState<'a> {
/// Returns 0 if successful, or -1 on error
fn parse(&mut self, i: &'a [u8], direction: Direction) -> i32 {
if self.version == 0 {
match parse_pdu_enveloppe_version(i) {
Ok((_,x)) => self.version = x,
_ => (),
if let Ok((_, x)) = parse_pdu_enveloppe_version(i) {
self.version = x;
}
}
match parse_snmp_generic_message(i) {
@ -331,6 +330,7 @@ static mut ALPROTO_SNMP : AppProto = ALPROTO_UNKNOWN;
fn parse_pdu_enveloppe_version(i:&[u8]) -> IResult<&[u8],u32> {
match parse_der_sequence(i) {
Ok((_,x)) => {
#[allow(clippy::single_match)]
match x.content {
BerObjectContent::Sequence(ref v) => {
if v.len() == 3 {

Write Preview
Loading…
Cancel
Save