diff options
| author | Luca Deri <deri@ntop.org> | 2019-10-25 07:22:29 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2019-10-25 07:22:29 +0200 |
| commit | 12cf0c47639a965d156ebd3a2a7721cca1331f23 (patch) | |
| tree | 72b4e1b0aa381d520e56b383166fd189658cd3dd /src | |
| parent | 0a92e0f5325c30b2ac690c3567cd123ca35ff8a6 (diff) | |
Further SMB improvements
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/smb.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/src/lib/protocols/smb.c b/src/lib/protocols/smb.c index 063262233..de83519f7 100644 --- a/src/lib/protocols/smb.c +++ b/src/lib/protocols/smb.c @@ -32,21 +32,24 @@ void ndpi_search_smb_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc NDPI_LOG_DBG(ndpi_struct, "search SMB\n"); /* Check connection over TCP */ - if(packet->tcp) { - if(packet->tcp->dest == htons(445) + if(packet->tcp) { + u_int16_t fourfourfive = htons(445); + + if(((packet->tcp->dest == fourfourfive) || (packet->tcp->source == fourfourfive)) && packet->payload_packet_len > (32 + 4 + 4) && (packet->payload_packet_len - 4) == ntohl(get_u_int32_t(packet->payload, 0)) - && get_u_int32_t(packet->payload, 4) == htonl(0xff534d42)) { + ) { u_int8_t smbv1[] = { 0xff, 0x53, 0x4d, 0x42 }; - - NDPI_LOG_INFO(ndpi_struct, "found SMB\n"); + NDPI_LOG_INFO(ndpi_struct, "found SMB\n"); if(memcmp(&packet->payload[4], smbv1, sizeof(smbv1)) == 0) { - if(packet->payload[8] != 0x72) /* Skip Negotiate request */ + if(packet->payload[8] != 0x72) /* Skip Negotiate request */ { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SMBV1, NDPI_PROTOCOL_UNKNOWN); - }else + } + } else ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SMBV23, NDPI_PROTOCOL_UNKNOWN); + return; } } @@ -67,4 +70,3 @@ void init_smb_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3 *id += 1; } - |