in src/analysis/cifs_parser.cpp [53:84]
void CIFSParser::parse_packet(const CIFSv1::MessageHeader* header, NST::utils::FilteredDataQueue::Ptr&& ptr)
{
using namespace NST::API::SMBv1;
using namespace NST::protocols::CIFSv1;
if(header->isFlag(Flags::REPLY))
{
// It is response
if(Session* session = sessions.get_session(ptr->session, ptr->direction, MsgType::REPLY))
{
FilteredDataQueue::Ptr&& requestData = session->get_call_data(header->sec.sequenceNumber);
if(requestData)
{
if(const MessageHeader* request = get_header(requestData->data))
{
return analyse_operation(session, request, header, std::move(requestData), std::move(ptr));
}
LOG("Can't find request for response");
}
LOG("Can't find request's raw data for response");
}
}
else
{
// It is request
if(Session* session = sessions.get_session(ptr->session, ptr->direction, MsgType::CALL))
{
return session->save_call_data(header->sec.sequenceNumber, std::move(ptr));
}
LOG("Can't get right CIFS session");
}
}