Feature #2675


Split out SMB parser to be reusable

Added by Ed Page almost 4 years ago. Updated about 3 years ago.

Target version:


Suricata has a built-in SMB parser written in Rust,

Splitting this out into a dedicated crate can allow leverage/collaboration between Suricata and other projects.

Actions #1

Updated by Ed Page almost 4 years ago

I've got a rough start on a repo for this,

This doesn't even build. I wanted to post it now to ensure I'm aligning with how all you'd want this done, like what repo is used, structure, etc.

Actions #2

Updated by Victor Julien over 3 years ago

Hi Ed, apologies for not responding earlier. Suricon + catchup afterwards took quite a bit of time & energy.

Some thoughts on how to do this:

- the crates should contain the lower level logic that is not Suricata specific. Pierre Chilfflier has done a bunch that we use (der-parser, ntp-parser, etc).
- if we're moving this out, I think it needs to be to a repo we (OISF) control so that we will not depend on 3rd parties for fixing bugs and doing releases. Here not all protocols are equal, and smb is more important to the project than some of the other protocols.
- for contributing to Suricata's code base we have a CLA, we need to think about whether that would apply to this logic as well (initial thought: yes).
- I understand your current branch is a test, but just to be sure I think the repo should only contain the parser, not other tooling. That seems more something for another repo & crate. Or perhaps it lib would be primary, and some tools would be secondary in a tools/ subdir or something.

Actions #3

Updated by Andreas Herz about 3 years ago

  • Target version set to TBD

Also available in: Atom PDF