From 5caab1a6673aa8737184104c2289803a7a8ad0ba Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Fri, 14 Apr 2023 12:12:28 +0200 Subject: [PATCH 1/3] smb2: Limit per-connection read/ioctl/tree state Users on Slack observed memory growth in an environment with a lot of SMB traffic. jeprof memory profiling pointed at the offset and fid maps kept per-connection for smb2 read requests. These maps can grow unbounded if responses are seen before requests, there's packet drops, just one side of the connection is visible, or we fail to parse responses properly. Forcefully wipe out these maps when they grow too large and raise smb2_discarded_messages_state() to notify script land about this. --- scripts/base/init-bare.zeek | 10 ++++++++++ src/analyzer/protocol/smb/consts.bif | 3 ++- src/analyzer/protocol/smb/smb2-com-ioctl.pac | 11 +++++++++++ src/analyzer/protocol/smb/smb2-com-read.pac | 11 +++++++++++ src/analyzer/protocol/smb/smb2-protocol.pac | 10 ++++++++++ src/analyzer/protocol/smb/smb2_events.bif | 13 +++++++++++++ 6 files changed, 57 insertions(+), 1 deletion(-) diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 2723c8bc2d..7220c538f9 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -2988,6 +2988,16 @@ export { ## ## .. zeek:see:: smb_pipe_connect_heuristic const SMB::pipe_filenames: set[string] &redef; + + ## The maximum number of messages for which to retain state + ## about offsets, fids, or tree ids within the parser. When + ## the limit is reached, internal parser state is discarded + ## and :zeek:see:`smb2_discarded_messages_state` raised. + ## + ## Setting this to zero will disable the functionality. + ## + ## .. zeek:see:: smb2_discarded_messages_state + const SMB::max_pending_messages = 1000 &redef; } module SMB1; diff --git a/src/analyzer/protocol/smb/consts.bif b/src/analyzer/protocol/smb/consts.bif index 321875b43d..6acd464f6a 100644 --- a/src/analyzer/protocol/smb/consts.bif +++ b/src/analyzer/protocol/smb/consts.bif @@ -1 +1,2 @@ -const SMB::pipe_filenames: string_set; \ No newline at end of file +const SMB::pipe_filenames: string_set; +const SMB::max_pending_messages: count; diff --git a/src/analyzer/protocol/smb/smb2-com-ioctl.pac b/src/analyzer/protocol/smb/smb2-com-ioctl.pac index 8d65312f9d..d37320ae68 100644 --- a/src/analyzer/protocol/smb/smb2-com-ioctl.pac +++ b/src/analyzer/protocol/smb/smb2-com-ioctl.pac @@ -17,6 +17,17 @@ refine connection SMB_Conn += { function proc_smb2_ioctl_request(val: SMB2_ioctl_request) : bool %{ + if ( zeek::BifConst::SMB::max_pending_messages > 0 && + smb2_ioctl_fids.size() >= zeek::BifConst::SMB::max_pending_messages ) + { + if ( smb2_discarded_messages_state ) + zeek::BifEvent::enqueue_smb2_discarded_messages_state(zeek_analyzer(), zeek_analyzer()->Conn(), + zeek::make_intrusive("ioctl")); + + + smb2_ioctl_fids.clear(); + } + smb2_ioctl_fids[${val.header.message_id}] = ${val.file_id.persistent} + ${val.file_id._volatile}; return true; %} diff --git a/src/analyzer/protocol/smb/smb2-com-read.pac b/src/analyzer/protocol/smb/smb2-com-read.pac index 04679d804f..d9b2d7cf7f 100644 --- a/src/analyzer/protocol/smb/smb2-com-read.pac +++ b/src/analyzer/protocol/smb/smb2-com-read.pac @@ -34,6 +34,17 @@ refine connection SMB_Conn += { ${val.read_len}); } + if ( zeek::BifConst::SMB::max_pending_messages > 0 && + (smb2_read_offsets.size() >= zeek::BifConst::SMB::max_pending_messages || + smb2_read_fids.size() >= zeek::BifConst::SMB::max_pending_messages) ) + { + if ( smb2_discarded_messages_state ) + zeek::BifEvent::enqueue_smb2_discarded_messages_state(zeek_analyzer(), zeek_analyzer()->Conn(), + zeek::make_intrusive("read")); + smb2_read_offsets.clear(); + smb2_read_fids.clear(); + } + smb2_read_offsets[${h.message_id}] = ${val.offset}; smb2_read_fids[${h.message_id}] = ${val.file_id.persistent} + ${val.file_id._volatile}; diff --git a/src/analyzer/protocol/smb/smb2-protocol.pac b/src/analyzer/protocol/smb/smb2-protocol.pac index 3c354d3216..f8126ba3bf 100644 --- a/src/analyzer/protocol/smb/smb2-protocol.pac +++ b/src/analyzer/protocol/smb/smb2-protocol.pac @@ -230,6 +230,16 @@ refine connection SMB_Conn += { %{ if ( is_orig ) { + if ( zeek::BifConst::SMB::max_pending_messages > 0 && + smb2_request_tree_id.size() >= zeek::BifConst::SMB::max_pending_messages ) + { + if ( smb2_discarded_messages_state ) + zeek::BifEvent::enqueue_smb2_discarded_messages_state(zeek_analyzer(), zeek_analyzer()->Conn(), + zeek::make_intrusive("tree")); + + smb2_request_tree_id.clear(); + } + // Store the tree_id smb2_request_tree_id[${h.message_id}] = ${h.tree_id}; } diff --git a/src/analyzer/protocol/smb/smb2_events.bif b/src/analyzer/protocol/smb/smb2_events.bif index 2071a0600e..9ef661df77 100644 --- a/src/analyzer/protocol/smb/smb2_events.bif +++ b/src/analyzer/protocol/smb/smb2_events.bif @@ -15,3 +15,16 @@ ## ## .. zeek:see:: smb1_message event smb2_message%(c: connection, hdr: SMB2::Header, is_orig: bool%); + +## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` +## version 2 connections for which pending read, ioctl or tree requests exceeds +## the :zeek:see:`SMB::max_pending_messages` setting. This event indicates either +## traffic loss, traffic load-balancing issues, or failures to parse or match +## SMB responses with SMB requests. When this event is raised, internal per-connection +## parser state has been reset. +## +## c: The affected connection. +## +## state: String describing what kind of state was affected. +## One of read, ioctl or tree. +event smb2_discarded_messages_state%(c: connection, state: string%); From 3ac877e20dfdff6d27f60b4fd1a3c37c84303d1d Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Tue, 25 Apr 2023 17:19:14 +0200 Subject: [PATCH 2/3] scripts/smb2-main: Reset script-level state upon smb2_discarded_messages_state() This is similar to what the external corelight/zeek-smb-clear-state script does, but leverages the smb2_discarded_messages_state() event instead of regularly checking on the state of SMB connections. The pcap was created using the dperson/samba container image and mounting a share with Linux's CIFS filesystem, then copying the content of a directory with 100 files. The test uses a BPF filter to imitate mostly "half-duplex" traffic. --- scripts/base/frameworks/notice/weird.zeek | 1 + scripts/base/protocols/smb/main.zeek | 7 +++++ scripts/base/protocols/smb/smb2-main.zeek | 24 +++++++++++++++++ testing/btest/Baseline/plugins.hooks/output | 3 +++ .../out | 25 ++++++++++++++++++ .../weird.log | 11 ++++++++ .../Traces/smb/smb2_100_small_files.pcap | Bin 0 -> 238734 bytes .../smb/smb2-max-pending-messages.test | 18 +++++++++++++ 8 files changed, 89 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log create mode 100644 testing/btest/Traces/smb/smb2_100_small_files.pcap create mode 100644 testing/btest/scripts/base/protocols/smb/smb2-max-pending-messages.test diff --git a/scripts/base/frameworks/notice/weird.zeek b/scripts/base/frameworks/notice/weird.zeek index 47a6b6dde0..919f683123 100644 --- a/scripts/base/frameworks/notice/weird.zeek +++ b/scripts/base/frameworks/notice/weird.zeek @@ -210,6 +210,7 @@ export { ["spontaneous_FIN"] = ACTION_IGNORE, ["spontaneous_RST"] = ACTION_IGNORE, ["SMB_parsing_error"] = ACTION_LOG, + ["SMB_discarded_messages_state"] = ACTION_LOG, ["no_smb_session_using_parsesambamsg"] = ACTION_LOG, ["smb_andx_command_failed_to_parse"] = ACTION_LOG, ["smb_tree_connect_andx_response_without_tree"] = ACTION_LOG_PER_CONN, diff --git a/scripts/base/protocols/smb/main.zeek b/scripts/base/protocols/smb/main.zeek index ed129f8ce1..91e27acffa 100644 --- a/scripts/base/protocols/smb/main.zeek +++ b/scripts/base/protocols/smb/main.zeek @@ -44,6 +44,13 @@ export { PRINT_CLOSE, }; + ## Whether to reset a connection's SMB script state whenever a + ## :zeek:see:`smb2_discarded_messages_state` event is raised. + ## + ## This setting protects from unbounded script state growth in + ## environments with high capture loss or traffic anomalies. + option enable_clear_script_state = T; + ## This record is for the smb_files.log type FileInfo: record { ## Time when the file was first discovered. diff --git a/scripts/base/protocols/smb/smb2-main.zeek b/scripts/base/protocols/smb/smb2-main.zeek index 8ccaa2df84..31f0a7704a 100644 --- a/scripts/base/protocols/smb/smb2-main.zeek +++ b/scripts/base/protocols/smb/smb2-main.zeek @@ -1,3 +1,5 @@ +@load base/frameworks/notice/weird + @load ./main module SMB2; @@ -344,3 +346,25 @@ event smb2_close_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID) #Reporter::warning("attempting to close an unknown file!"); } } + +event smb2_discarded_messages_state(c: connection, state: string) + { + if ( ! c?$smb_state ) + return; + + local addl = fmt("state=%s fid_map=%s tid_map=%s pending_cmds=%s pipe_map=%s", + state, |c$smb_state$fid_map|, |c$smb_state$tid_map|, + |c$smb_state$pending_cmds|, |c$smb_state$pipe_map|); + Reporter::conn_weird("SMB_discarded_messages_state", c, addl, "SMB2"); + + if ( ! SMB::enable_clear_script_state ) + return; + + # Wipe out script-level state for this connection. + c$smb_state$fid_map = table(); + c$smb_state$pending_cmds = table(); + # Not expected to grow overly large and the original + # zeek-smb-clear-state package didn't reset these either. + # c$smb_state$tid_map = table(); + # c$smb_state$pipe_map = table(); + } diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 97b230190e..8ab256052c 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -575,6 +575,7 @@ 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMB::enable_clear_script_state, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMTP::mail_transaction_validation, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> @@ -2194,6 +2195,7 @@ 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMB::enable_clear_script_state, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMTP::mail_transaction_validation, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) @@ -3812,6 +3814,7 @@ 0.000000 | HookCallFunction Option::set_change_handler(RDP::disable_analyzer_after_detection, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(RDP::rdp_check_interval, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SIP::sip_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SMB::enable_clear_script_state, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SMB::logged_file_actions, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SMTP::mail_path_capture, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SMTP::mail_transaction_validation, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out new file mode 100644 index 0000000000..524f00fa21 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out @@ -0,0 +1,25 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, read, 15 +smb2_discarded_messages_state after, read, 0 +smb2_discarded_messages_state before, tree, 5 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, read, 15 +smb2_discarded_messages_state after, read, 0 +smb2_discarded_messages_state before, tree, 5 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log new file mode 100644 index 0000000000..f7d257af1b --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 34884 127.0.0.1 445 SMB_discarded_messages_state state=tree fid_map=0 tid_map=2 pending_cmds=20 pipe_map=0 F zeek SMB2 +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/smb/smb2_100_small_files.pcap b/testing/btest/Traces/smb/smb2_100_small_files.pcap new file mode 100644 index 0000000000000000000000000000000000000000..4bc38dc36acb1212a2fc06fe6fea9f797b189fff GIT binary patch literal 238734 zcmeF4d7RGW_y6x1Ys!*TTJEx>Xpt>Osf1+Y4#`rfkYvj)x-E^R2HBI4J-b3Ky=F+NP;h}`maIzHLLRn8p7weySIXYdjo-5skhe-)XsnU`R4-m{egf#kgB_U274Sg8EcA=~l$NqO=VK+6%Ml#wbVPv=NH+s^tm8dpO{uGIdHZ-_?RU8MXTs* z>YDt4iXaK@?hP#_l}fFJ7Eeu$X|ZH-;9Lo>MX>Pm*=C_Swc!)772;2vCL{JR_Cf3^LxPeFq;rep5#0i=Ydb*XRpTt981Ce#JQG5 z_x7w)f9lYCrXT6o?1P4tZf$%h?Xt&TZr^{r=L%T&+zx;3lyiXD+j6s zY6L08mdOX;s-_2PVI?eITmW0@TyzBYiTexB4blPiA@| zWcv5CVo7IXc3X~@ zk9*)>T%0F4P^EIU4wc(huJmMwn$_{&Q!510;4`tWePh!z75eXY{7!?;+6n)+O@sXT zZ_1yPFJJQPyDHV1U8K@Q`3u3$-LC^F;fnI&|vxRQo47 zb$jB$`gN;Su8~r^N7tv?_I~P#PEU91-s>qa2AenEukNk%>(Yxi{P6j_Z;$p^cyX8Y zd0Us?c)=TEmfcXRdCL|l6)@kT|C8V|%vo(vSf8`hJ5k}&!&zb3L%)YNZ<(v)3>E$i zEj|hs-v!TbcW=~{D^l+wiv?m@gq)q7=gHY;V4=S|XGwvfj!_mjUe2ySlk#7+3Y2pG z{R0m*3N>rigleE%a>0Yn|B#SOG zaCdK1)3>KjMT@J-#I%StUD45J2PzI93*1RbR!l zh$B~)dY430 z^?evDt^iZGyEn2pH?kOoI zAQi@)x`FG!7%K9!QIYiNQ~~AKe^~*)2SX3vs8gir*8I>l*gM{h6d92|gDPNWOpB<< zKu3{XIEH|YCaNM_0d7TF*WP@!Zfq_V;93a;76-1SxLbgihDxYQc^k}Lib{C+#_;B? z4V1Xi%U!7CvtV%*xQn}cqqrBO)+37-#- z`Uctsx&}H0o&?hv!vLcy=`%5g)nz#bQ4L!gKs8L)sdCAO#%h>_7FT^1(_+?YKvlHW z;8tb$Jx#jltAXn$S`8(^OG7o>OSv1!Udn2i4%MKII|VEvA#itZR1G^*>!Za}-^H|u zalfCX8m73bAzvW63d$$V_rO8im_RY%lhtKi*C1H1O#pKKvzt^;W zr}lWny1CP+U;1o}c6DivR@Tk*VCaz);K(`Gs>SK1dLQQxTn6so?%q(pq=M;l(Bi5_ zF)gBg|2g`7j{ON1cB=ZZVO#wk1|#@yX8m$=J6x5_ePSpb`D;G9y~WRq$!}bl?}B>x z=~FM&IEcq7u&3ZBunApD21>!_tn2QycKE*n`OeZI%LmlG5vXLS+xt+Z(_vOg)a@fF z;mzA%X6?}(Rr(w)J_Z&y!SBM|y;0r1mD&I;p87AQMbv%1NB7Uc!gFrjFLc$dSTl=J zEMDFImsBEfPTAbvIiJ^#)-V-jd!s<}9D#29B!6HW{65^> z8woTd{dFqLT`?`9Kz*|al*$4@p}dCzabemDgu^^-n7>=WJwrvLQbqJ<_hdz^hKksz z3;1rZxE$=`?%pWiIjIfFVxgE8G2mCS1l)-OMr*}f6(QFD@hhT2AUWR%__rP1?!f12 zhfxL8F$$7Ck18O@?#l{*6LXK2(FtGP=qHpH}uf`I4pgbLLZ zSZJ*Z!WCdE$OSOLEdhpZg;P)G;8+m$2Lcbl60#X-a4mRjD2n?jh0n6bq9`6M6W;tm zP^UplHBuW> zGJCP_vONBS^7vX&1AYGjE#}>B94DHP#k?^sddq_>g40@f@Pyc+JTAm}tJOGh5xB1( zIMbICU?v1n2IL7t1o45MJ;?-7iwXvF8;T{Vgx+H z-Mvx#tJ2>@i>oHZw21L9$`b!THGXD>ZTz*^jkLS=9C&L+Qb2d)pK~2iqfJJQQkzjm zyKzLaMz%tYY|&}-8CX05zXf;qMjCyY`Vd+?^+`;NsL{t+G@9ww$h{sBL!y{yn9e5Q zI(kx4{w(W}{_y?l-7eziwc+>6@8!{)k8=;gqSL-Ls+hhEV_xm_g{-tK!O&w*>r`y^ znQ_sw94)Te$|`y+qKeT)3lGE2qNQB2chO?2BEyS@me$~29gqok_eM#smf9TMJKdGt z6J_(*)8Wk@71IUW6)YYAQ@Fb~vbZy~1zJ3{Bc??R`28$pqdomnSelPFwB+RJmuHRo zrLUlZaZW;u^nO$<7)PeH~adAh8u$EF9A!>h1%HMNkCT z;?*r9QPmHJ`}d9Ur)N;z6=iQ_l^lV(dqNlg~*9b1vtJD)}TO7Zgc@0^)97KaI1^^fxVtyhC~17^<7n}e za^sV<2pXM>@=t1%$ zgL0MRocs6Sk{EvvZkLFIb&sfau}8WX^Pj$!dc^5ySLF z$7Xjt*ykA23fOJy22b~NfS>2fmAcEAJchuJdNyiI_`sJZ@qebdeuDoUWCIqw0gwLq z;XEYzi<@ozB{D|g@4-4P3RP7HKF8g?(a2jZ^$D!1)9t+DRGXFI&D-HNr`RmZ_htUT z0#E^W_eSH?l+-q8G4p>hE#f#e+Nsk$NJsdpjXSSAPR$0>cwGm#2R{10yu5!=U6zuQ0ectwjT3;z-wuP%e%fm=KsFecn$jaSz|*7S9dz7Dgt z+M$aWUAAushT2`O)B$E~4_4MQd-DgXLk-~W-lz`Br>{qgtBP|Scr0QaTs$@42J?8;1pbF@9XKaeq&sY{d{W>&>`kE4m=-ZFlhnKmhvu z^=UrNp6II2Rs=&&4%5{`@%_d=-AH{}ET%Kxr>DuD zyH9QNquRqhEd?qX`t(Wa)5lpw(Wg%i3vb>rPst0a_$6Ar_NbAg?Ws@yj%m@$(XY^= ziKACiRl?W@*FxgmZj>y4)_q8mU*P3*9#s0n1$O3Woj|=nDA2K<&ao|bDhW^ ziOZiNuJb|HS^8C4UgTD}&?b-^C{YVWa9VNC0zD0ccn|elO^-pNrh*VVrvyVCx9bRT z{c&TRZ$^u&F5(P%Ec&c-TSBOH#2HuX+;-$P*>l(VwU(Ju?O~m#fQtIOq&|%*o_>T? z6m{NldwBD%(Ym~>Gv_5jc~Q=j?;1^+_L-Mb*^FD47u!)@)zNLwofq5DT(yUJdEcCu zj+B>&v*zXVG+kbboyZ>;oE)HC3P%SV(UN7%Q<{U6CNRYGf8P$sNJ8ZYi;rIV21rMC?v0b^{ z^fezH1M(BJo7eTt{v9ud*AU>$lr4+@ne^DHGG)MS{zsOT#Up>sN0$lu6z%d@hTlk@ z-HyJGk1JP#8E$Ww>9&O#Z&&!d1I)d;LJ{?bpTPRA1=WaWOK^8@SdD>cshzMIPo3gw zjE+0IH{dMg>{w4Vehn7dd9zo@FyF2;&{By1&YP8O%QEFGJk>;$CtPyyMV9!Wh zjT{DxhUxb+R3j~7S_F+;({I*DJN>>v#uBeaa(nt+-qJ4~w#?J-)5Z*?e@HdwoK}-H zH!>LNJVuwHr%oED6Ca_)4CSGxJ;EYn$Tgk#1_wgZbiy`6iB2cpyJcD@6#c}sVgvCw z1@;vD1h)Un>4a@&&rc`Xk@hyzi9t|}Ffi(-6WwUMIN=>HI*$o&-n&(qPGB{D1BSHI zi3;RX{L{wVmugjcrxPQb-+clRcz6CYDw{>grezTCSN`tr2Wm*h8&#k;_wVLI^% zSzH{`BGM%~onR%j(+OK8F5tk>y>E;Gr*=p8PCv-*2~>1G9p1dJxGvzoz~W5!6}Y=M zl5l)#4@&(XF)d=i(dh&StesBWD9y)11y3i`)MNa4GK~rUl+xpPD-yo1cretZu`d4R zU@-!o;qKn#bYeSMbk3A}EMol7HF7$^@oT3Ow(%!Aofu@)D77cmNE2^HyEKLxQC~sl zG{u`>(J-CpMK#hirbW=mHJxCMw9|>3WD4TdNN!IjZnpG`hb{ATVx2KV>7P-}IakwV z&B06Qx`uRB-0`$=I4a@&&rc`XVH)He6XvrMi=i3~(}~_RUi{3}C@9r66yE&RXMU#>aDyUk@x}}8OSP)J z(}~sKcO9^YyL*$heDM8S=GUtgsRMCjhP2Ady~_NFUX?v z#HPn0#vh$daQxcogl+tZPA9%IYLxmc)yVyAR`soYkAGxz~cBZiRIjYJbK! zo!EmGGgffUJr*HDuIYr#kbXL0o1sLf6TMbm{Vj@Kw$>Lk56`LTgl%TePbb<@57?ZY zNP}uLOegx&cyXAkQH&Se3Wqm;yH}Y`@OYs;J5kwZU#eB*olcAazYTr)CH3WT_FHt( zw|k*4d+Yl0bFgSQJF%B6&WLFd>EfMEU_WT56ShitrW4;715SMo-8t zEJnaH+})d;PV6U(&eN_Qix|I;>4a_kiB2cF7&S^AKs8dIHIf;HJA)3W_q6hJfV!AOy>0eRJ{lt38nuEJhyQ}vaIT`xq zFXMFLYqXfLB&J2kkZU?|0GAo2vlF%%N_09gwC3e^qUhJ2XioF+oSIJ9X7>Daq8;^s z&2-{-s7AwdVi1iN2e=x=2-F?!**bVonNDCe9)Mq~ole|FKG|RFP^-#2ok;rINSAM@ zFMnXaMPD8~7!37L@0}pOapbHA77f#hZ^`1TF)bopqSFahLOY$XRl+l!c)%EN>R@#5 zbX|5&B&rA8J8|e11*cBHUBRMZI`KTE{>PXWG2rNQf&I-TJ7wPz=6<4<%tvDc_kY8utZ zJxWI5-ibqR>T2X1STsy0hER>viD?lua!n^#BkkDN!T2p?m)|PA3kb#f*6|EkcHr=>!bm`m+ zRe7fq9l`H9U=ersCNFk;PkrgUQD5}s;iJ%(>b(;VUET$YhUvs%vN(a2@K{8;M5hzq z$%&PAI$^7XXFBnbG2ql;=-%nO*gcsjxOd`6b!8wz_r60w{|FWh(~04fdS__!Sj2#% z(+RQ&NzhIwZkHK~hYFrfsHsP9e>29PeuUEVEypj?bEJAO)Jwg0!im4`f5z#=4`i`* zOp6$QbUMNDYo`;o@h3W+Xb2JMn%(}ole|gStHmy$?|92havKd0&wJep8Lb+X|Qu$!Kbvvd-~7)BoyZ)UhVR* zWxm+a&zPa~AF1ZPW<6yUuL*{FhjbbG@PEeX#7}53V`fZ?kRjJ}LS{%mov_VNqSJ|b zZ{JG`uD4FUdlJ(%1@;um+yCvYn6{ZcKb>et>f1~wzK3cwOefN5yx7gvD8`H4aPP#A zrw9)8VI0n9+0axQM(Jlv_`W>bs?2@iLm*sIG14 zmmRAAGS}QMR3Up5lo&nV_QKG(L_hh2rzJy~96jZZ&+I2e0id(!kV^ph&LNO1R z({qx38$z+oWJiNE9Apq=-KTG zs-2pfmuy7!X|$Lzku&76m=)CrO{libP@<@=P~g}a6unr>#f9;hQ>eDh?0HnT!!%eu zk+2%7(SYhPG+unh)hGz?EL`(Hk=HM(?E{c@|D}DZXgpG&o3Sl%&30NTyuX>g?z+% z${}G_Fw|eYo{oAR!YbaM*NE!B(PGBvm=?XLCW|Ii+h!vKsZP>QwS6{&>NCsaBO2)p_$7 zS?~|_VDv!0o4;IQOcEy z{%}40PD7+ z@sMCfby9xgkZ_hNWDDylP<`^NU?{9!t9EMc;Q~ffpF@ioFUGX!6VC610I)tSGo9z@@ttv07 z2ZG;qz#8uEP2Bo6B0zn)nf(@hdHOQwOZ8gy_dJDu2Q2DQJtB!L_Ks=Mi)yk6K50>H ztAq#D`@lT|swYvRoKwm&QE;vL^pgsz(Y^1%JuRvqkb1^T6r);A6r%cjb9$0V%uR}z zPXa}X8FE1`+ zM0EkO_)JWTSyBBx1gk~0tr8woR{-}6sD70arCg~P2-m95boGns2Q3rDs8$n&V66t; z8q!mc#C%5)vn!-Wy;kj{X98G^fM>Y7H*o@d#06wg`D?;wghijIwv9hgR4;>w45*$$ z8NG=$lC1~Vs?Yr57uC(AVDTnjxsB?FEd8=W^*iR8D?}CYHtQ)+edd>7XpnlX+Nrq< zE;6F}LbRBnyi!_P^rHH(m>%m<O@1R?27*Pys=6>)d^)B@FREDyEvjvm@SyrtaL<71X_P4CO2uHfR{eKh z1=Z}Hc2(WNGEt0bHBl($9CLb#keDkKG5bP#)N9pFdX9rd1FDOX#VRo^dQr{sYgg5_ z@h6Jv;)RWiHyEx}|NV!8YK};|s%~kS(cDILD@(uZP<=J%X&4fUQH8w4 zdJ0tk{YNnLyn3zLsk!b&jHtdCEoLaMYnB$Xq8bKAJ*sUplqjkT&e@y?MbDQ%Z3`ZA z3e~omJ&$U8RF8maG@yDqjTg?DN-Bf}VyU;WDa_ zrL3nw^?zrBp&{zEYSi-xR`Jyr8&Q2ZTFg*hg)A+4QB4+2sJ6{eqNx6|>;o%M@tGgI z`zIcA3e~omJ&$U8RNn^GXh8KW8ZS0*eT(s82wbZ^ce{dWS&jNt^-QoH>c-H5_6#L;XN@meppQQgMUFP^=dQGGS&X&4f&rV5$QdQt;}mch_4^;)%4bK@^DqB@8cGrX@E zW{X}_|A6o}q1rY>iK6;}YMGy+=#_2^@5N(Ip}Gwkhb>;kokw*$(#hsp^#Z6y1FGlJ zc;Q@B6ywFP!r@4AT?N%xjX%Jz)t&%vOFqTV9`~hMRbEu@1HTP@c@6dD>)yUht_yvs zUaKa*kuEh$7*TyKS!^EDq8HVygcjAdN_bG+7~C_U`gKZ_a;0KeZ%EX51=Z}H7S*D7 z;wOqxttJY^Yz5vL(o>4WoTG?29@3*;t9H^e6D&rcgm8Cn64j;2VyT!Gy{P8+wWw|< z&Bq&N5=He!h{&+2o<|wImLrm_w<8?MQ%pfMN2Epdla>+XHmciO`o%+n8P!|OHCKiz zWESfwP@Sh(Ff?4fR_)YW;meGuE{hg3+Qqb(71b~}>Q8{%W++iq56{1G1B(9W(~n(^ z$DBg7ZD!A-T8uU}s4fN7Xh8LR8ZVr`J1EAB;oHNJe2x5~nx5l>>WDW2a$l-d<02U3a>T+bUaZHOoQEjV)2h{_>Jp-y2 zP@JC!Rc!^?EtBFEXzhF+!^(5wNikMR&J?gb;Cq3K2Vgx+H-MvXv z-#`|xjA_v)s%_&>6xGKeA_J-yQbw=lh(znXFfJU)e}!LEKP?4|m(kotbw^9Tct|j# z`ge29m8S}s%6bY^=f5HtdQrVr?bKXKNh7K&pv8>VF)eyg{i9gN=uvH(p+r%A;=M66 zVupilEk)B`rCZV1(AK=mRTFP!^-#CY-Im~fgM1#79ACyw2TLd>KmyqU-foT!RFAH>a}X}8|g9uEE-UK6Io1+Y0-;n zRzka~wpGG|>P6t50o98sQOcEy7f(Z?<|?RW_q40(&Qi{J13RNyO%#gxmN`8)lbEk4 zV$KbQ($#C#PI~?XixKb)clRbyeG6GE5!0d<)f~TeRc#x8qNpx;g%Q~GMd|{?rQ0m9jZ%%o`xZzB2~!CtfxTr1!aPv5$d&Sr{+3d zX+-s{Xfeb4GF!+FS-VDQ4}S8;K0M|Ws%74Ebb_YPG7os2&b}8~U;m_2mR_Utah)bdh?k z+Ud&(STvxzGFf!~1eoY_Y0)RDZI$q#dLOuFK=m7xDCJ7Uh?S72rG8P}%`#DpYBf=a z>VxL=R3S0PDd|}n42@K;RXgb^ca;&NhE) zmvKa*^+v+A>WgktP>m7&1WD7Py1QjYa~st?Ed8=W_5GlyVMwS(6*7kP6b*dQO~KG8 z^;$LQiB&x3Y9p#|LyH;Sm)Syg$f6h3GDCV)+h!gALu?cm4a$^PrIt_CGr$EQH*LeQ8>t51Kt|alR{#SRMN8w(xYChcGB}CSd4&YxVtyG zs;)^E3&ymV71anfEvjwfPZZU|AtD2+S5QVT;fQ4G!L{n5)%>Emw-hX1>*Y48`&jzL zLxTAP_!x7|-A)yf&U%UlE?O-ZdP%)j?bO_^YmBJA11)BFUuFy0A&WjyZJVJ)QGG+H zo&8btp@Yv{i^rTowQXk4qq-fY!D>}~1gg=1>bGdTaQ+It7%yIeYtQxYt0o5xhqs2HP(R!od zT6OU|6;yLX+EsNwDcJvSs3vNFZ}I%HL-hu8&DEv~8Nzys1}=VQFf>NJR_)Z>xl%?{ z--8x2yf3qb?2tt-s%3`st7_W}C5r0z);_lni{Y&UFRjC4PNCX1v*%IW4%1+T>WfPo zQN4=B3+JgCFN?by&wKl_ z#Ba}X8FPno!!>YP2S#(~>EIM6U%!+Dcp%&G)N_bG+9o#dZdNn0Vxl%C(u2q-V z<`>mrsb{Dd+xja9EzJL!pl#R&XH+})c*^}T3u<$p0P z`b4#D{E4Fa2t;H+^%}}(VU9?&-dMO+eQABas2(5%iy-apmVj4eX6+utfy$;OX~+iQEi){L{WYH)B~$f^nXgE=EdU_*i-Nm*hJ<^21>!_P3w1RkKfy! z)(#JWd}ry9<-^%#p*po?O%w@~2;`GLVVl|Ws22L#+*Vc}s?o5jew)UNd0gLOych@9 zsxKd^pcOnG#wtcBql^4~G!S6a?5qI|{QQd(0@;UZf^yTG4p^MaO)#NwQ zWfWL6pgNT-I`4V(SoETrmC&NvRtXQP=Ye|$RIjB(DOW1S!L{nkcPOZ4_q40(!BWq7 ziQ++8O%#gxhB-YANz8sqdUgauNHEg>`)y9Jq<%bBdWQ+ ztfy$;l8u9*3F@_Kr{ZJXKisBT9+V1w#sp&AXSUPt4F^8lMLLJi)x;l#~UxWFV(8@qWXF8 z+t8N}P+#`;_T`l?K^Ljls-3=E2Nn&eZcG-Pmq&?Cmll1Z+Exhy4;xiWXO%jA_v) zs%_&>6xH=1BEzbB17)-TM1jb?c2UxE2-2fo zt9H`!2w04OXSlmJxvFl77FQmNY0-;nj$gZ~wv9hgR2QmXMD-@hXkLy;wBE~bt@@g_ z3aU9G?W#Im3KnmcoZF}#Vd)nS31(DZ4SE`Ct`*f>C)QIm@HK6Np-JksYNzJDywQm2 zhtXn&_hq(_9kS>}^>Hyc>QQZ*p+r&L`0(%aTv(Z!AJKv#r%-L1+4HDwM?GMJ>eEn- z22{UCVVangLy; zUaKa*kuHzjWJL9&WYKxdRdl+v=tVUvp+&W=5*}2a0rw26>dllW^2n1X6{ zPmAhNmWg6itBFD}AGq0=p4KGhQ%ZV{1w*f>*Q%ZLyag5`;2G}jO``fSw7Bv}Op9Jr zbNpIV+s2r(u+fdcnEauXh>z@CDiz!vKYdGhRb^#5$GkmK(_;~0-^mT`iB z>wflI7Z3XnKkC^~KNOMu#4pqEgWUMvm4dHZThy{UKluaKI9L2_t0|F@2wldidkdfWnk5{LW^g?Vk=MyclU-ClNzRO zrP1iem=CNTZk^nt(O79dUf1bHqapI&=j3Qq#5GFb83Ekl`5S+Uf;zW- zx^Q6Z4FTGPUGWihz9DVI6R7hT=b>LQUX&dh486J^$BS}sle^$Z#*>&isD=h!ovGBR zzif3*bi62YXZ|ZOhF_n4a|<5-FUJe_9W}Oj!13bd>!Fg-8Q9{D8{(&;A8|Z@k=faJ z+^8tO!**x=a&x;1Fs{yhVkjN?Yd$&#Zax`910XPfN%?f6d2u_Ge1_)nP1-@Sw~YXqvqw9h)Uos&I% z1~~duk7=Lt*tYoMY~^>Pv|lYyDW?5I{eRB!zgkTDtpA*A-^iB!%N_k=*C+RD=~i!& zeg2w{@#^P2X}@ORwwV62{&SXPPyd&t{oCT`f2iYp@}Kj;$9Vqtb@Y#&U-th{L(yOS zH6P>If7S6nc7EB<(vx1#mj6Aa{mOyZ_0M^1`+N5C`@XbaGf*>Tez`tNXLJ0SEA3a; z)DPRw?)bAr+OH93{LHTX1&;r*_2D|nZv9V^_HWaS&ul-t^*PP4Un6FI*?xA%&vDXz zwK(;8XuTNUxL)}fufNtv`zf0G;r?p7X->BKtDCf6SyMkrzx+mgclt|y&EI$CHm>=D zI9DJh2%V*UZ}mjy53GN7^E+AEzfI$RqV}ga_G6F#oX70)Wuv1{?D<2Y7$#ux~`D;GLtIv*(efR7zTA%EHcE|r&(tdT# z{E+>eb8MEFpD6tmZ+z$??c-T9cLb~tj}LS1T$ru#VX(AcB@Q21f7XkS@%&%r=pTE0 zW;@x{f4-xC?D-*&57{06$4dLvG~;uk_D4DPW3OL0zooOe{(4s0ucF~E>!02E!yD3m z4UIlr|E0?ce(~3Qj8{L;Nc)vF{l)%gw|?eH`_%)n>y!QD^)-LZ$9Utawa@xww}0Ps@*8`8&hrQ@S z`_KKG-TCbVX}_B0{0aNd`Q@+q7_a_kIR3{T|C#UEou6!x_G@bV=lmYppFO^$N&8hb zv|lBM^1I3LUo(G}^EEy{!{ag^HBJ5S zIFsG+bGEc!T{Hh@|9O1lulX2ne48rm-=%qYu|1&;R*rKE|uh^|C&_tJ7$Ga{Xj?{;*Q|pAu*O#`VL$kB{;6nJ(?$ zrdhu*U$T3CvX``9Su;Om`>a2I&Bu8D50v(+XzX*HWVilbarE(KnAeY7Cv2a;=3~72 z*(mGBJ9|XE9WO|ACTuCO%x^0#A#a%nmH4NM5I%og+Yd*&Ff2iZXW`4rw zC*}1!u1h|~tIwyUeedi)TAzvLH$&P_(adkzes=jg$MN6WVXQyb3HL95&Bu89Pn7nn zX~s|XKfC7#7D@Xx;^>oI`wJcWvDZheLw3iX5z>BDjXvB**`5EdllD_`$o@Ny{n+Qn zxQ`CKI6GVCC%a1fl{NWg{j)p2eM#D{rkOuD{`2)0<@{>A@u8EWPjqa<(U1Ep(fqD; z?8lyeCaTY9N1xc^Cy&F~9iN9u`&BjT3$~x#^OOCg{VJOLvi*$H2ezgtK99n zuM+RhdlD^<=~&qG$i@d`aZ*f+aKGPKxQS2R@7EqJf=}8r~kEEMyz>dzJE+(Hedg3{AP4o?wXHr-**H2iLR@SlIgQJYa$D-45;<67?a;`nOls zDR+k>_ut^X9Y2HILyLXEqT!K^kI3Tmm=-Zn!##<@fVGcoOt4H;N%?bXqR`v2oeP^D zuxN|kt~|)zirYx$6Jw=?7J-sqO*9;u(8#msdvE#fWBpo-L}gDByo6z{FJ(VHeF zO7r#i$9=%!T(a90`FWbWBb{$)t_|Ps4;P0aO#y5V^8*%q(|UBe(**tv->P2?K7X)h zBYJCn{i7f69<;fBkJ&pP$aDJH&OPz>*=*(EhuB^*_`F_&ZcTOnF4lt{nBOaU6%GuA zOyKU`C>wo7w4;hu92{ht?k;-`Js|OM#?`;!xA4a2d9as)oz*G`pQ~!6xc)!>EWc`y7v{PLDd0yPyNP5K zb;68X3mGwV+^5uWe|Y<2>fUgq(NEBEXI&kK{m}s}4g-sCgLT~98{uUOgDd`yct zhR#rP9O&uJalt^ecV3p}>+i2-e59!|{v4L9+|-=$_njk#F{*drz%=*{?(U7k7(L=i z3}aP(4nqvCjeZJ-ris5apOz(zhtx2*RBgk!IMBp%?|9`(l?tJ!q&?-ZKLJ@IdSyFzepl z{CNNF_kBP9mZanTO8)RdZelR0pAmykQN>=(*^m{xDHwX~h=M`Rh8Bai*>Er@&$H<6 zYvW;**N15`+iQ>fa0)*?`p$r3cuW+7e1Du@4EoI~W3V7(#L#h{Q^)|I6kIDF9kc|C=8xzDfp^X)|P^5<}gvM`Wq?uGP< z87bJ2Dpq-YN8>Mpp&6M91vwj93fg8vrJ(NWiH?FZo?lQEvp(l!`{H;^l!AN}#xDi^ zW|b+p2r^>mxP8=dN4@Crk4dnGdn00KRB>#4iPHy;UjbXH3C}rb0x9jDAD<|G*K+j7A`%Cv+Lz1Qrbx{1z={E{bWQVwHD6G(8av%{r@4 zu#=d#=}(E;W<#Z*?imjq1#cO>_B%}ch9-x8!DFHnd}2oN|CVdPu2iaLSr{?6HoGMln%!HWAcvu)plujgC|HFkm^|2+!GomtA$C;g zJsaL<-fXxogB8G{fr5v~;_#Rjy%glowG@Q&-?YUWGns;F<}gt!z}pB|!QH)4qE?M~ zh7z@#y_Ja?4v7+fdS#KbXlHM=XGCqiRVnCaOu>lOnKSx5>Hi%^Br^){Gk++rE~DRq zMFRy7qs7d*F)ey2C^gcr1+i{$i&;^>~#*HN(blE5g;`UiO$ zRlsAS6yzuV{Zi0xR+)l@AtMF~9-)qNuBwQRn|on6(!8G1ahQ?L*uyozqJe@xkVWSO zpdO1}3X(;TR7=5GC^&3>DX8X5SaE&CFeXA61`2kkQgv<*5~bR_9+YaDLO~8gOF`Q( zvQV%pQE;X?gFlkqUvp1Mz0)9rujw-QF<3NE@F%i3IHpA}1vzvr1!qgq9ZIUQzZCSFRi@w`$cUlij#0-s=aWRo%_|v>w0u<8aTg9VQt&ugZ0qe|Y0)PI z=c3@S`K6$mGhxN`5r?9l5Qc$*y{J_G;xI(1wtN&yb&OvM+J=#Zg4KwEgTPTk27e*F z_pqZfgYdfamKnMXE(41O3Z5W~{bO46Qm_loj6hc{1z(q<+fq=?946|z;YJGfrbKkfJ0ge+Ip)}(9f8H5#0h288Z4S>Hh^sBr|$69BEZW$tXpH79RqO z1`7U$7BiLmo#qLPUJ6Q$^c2Kf196L&(VU~8_jy7c1NEPP>{pWt_5ww$U?!}h=Lct zXk^wY(p$L>yI>k*@FQ|`xN}C39n~^xfs`oT2*)coRcDlSAb1-AJGi?ydH(WQlJyg= z4k_zLAnO^w%(C@XWtN{203(_S5g7<`8Y9Y_$PvkUKNF5Tl1gJ*dsTluVHQfk;_07r zgz-L;ts_i_-miCQzqQUcGgcg^x_aRn_**G}o}*+$!JsD#nI*Fr~_ORu~4Aja9L$Nf*> zF;T+s`+NNo#&1@cFsmUW1|IxQ<5Mfni0F?+Rl<=+M^eYbWe9njA!ej22%zNwoYtYu zFAr3OrJ3jf3+pU|VccoSxBaA%w zgY@pfj!L~3g5C$o(I^ktQ7sP^ONHW%N6Z6NXOwjmcx&Lnb0q7B?5&jbU@){e4|xk( zDY9zUFt*;RJn+-67|}wA$iRa$7*Xapj!5XgI8Qjzx(!C;dMr)qujj!MOZ{_>2i_;- zbvzh--|2@QxwYQM>ED%^-|)$c1G&kAaU+d92vdC(;B1KcYTYInT0+mcx*kj8Y-m>; zw%JIO2W#HD`D#r34@tEV1qt(j- zg9l4d9@zZyKvh^+aec%#{{zA>@L&KHmh)JFD6Ge3Lt(9=Ffcw#9@vJFg$Ff=2bYa9 z^58GhTe(AJ$tuwMPjb`;58jXx+44Zu8D$*=-Wqr?kYwG;)gfj5GZ^ZhX& zPa871Pj2#H=u1W(45Io{9(sAaUoi9rJ^Sh6!82kus$U=2W<%wH?!6ki^})~8TO7v3 z?|d#yTu5|%!0+eq%LBhzWgff^88PtS9~z$?^!CRa@QmvdZ&Sxdd4L&t287VA50*Lo z;qRehRbgo+dcc9}D1>3)!C)$^UpNdga6R!h6xL=61OJEM0f(VoAJ~SGg$F6bgF>T? zJouON?#zyg@#u}s;YgbzU_T#13J?PpL}A`Fbrk_Wb7WZ^+g z;=w=QsNtITS<+j%cW>Ee;Yd5WCg*xF5|6N29%MLr+wnlv8D(uZ*2sgQB3B@8~yUY)?1Yae)<(78Uzs;cyJCQ%6yR{5hF&SH~M&ggZu3b z`u8_1>D+J0;JfZS{?6{#n!ix!bh+H*!DHi$JQ#-A$WR`HXg5C?T0xHkx_Hn{%trM* zu+0YZzqe^7XU8R-TBXx9g;P#)O)o-a}r7FJvzvCTI_7$`mN?u{;djv6tX z1}^9EO)+pi`2!Tz*A&KJhX)+SgSxjZ*oJ{T;9^0K#ABw1!B0I78YYq4?G?Gd4oBMG zL4HP;2kfU72dkwFwx^3!nNii||FF%Y!wR`uoFy{p)dv4;O zj03*Woa>9f<|Efv9+~Adc`RS|m09@dqni#?#bcs4;6G>U7YBZ`$~YJR88P4>4~l%NQVc>Q6D^5DU`)Q0|TI@Odz_ik=X2 z@u0hyjOuw{n+=r*y4SkvcrdbOg&mmqM&;h6W1>9ZKVRvW2Y$24Jm>`(G4LQijZgKx z{jmxjh3igz@@zKxnprCtUoA> zC=WOcEe~wN$if4$KKKG0HSnMS>HWB(_aC5lCvr5(19nuqK3MPQZFjmz)fr{2Hp$3? zmq^w%?5*HI$4Zasvln3msc70&$t;z#G{fZH_hKLM2D2Ned4&sOe4^}q?{f}Zq zE*{8;^y`BSmip%$5A0s?((+iouLrzZfBDE>A7A_G!<)mo$%A`eG4fzEW+OwnOT6RJ zU}z0JE2Z!NMjt&7Y_pLl5B@vbK8%Uq_WAYccubTB{O3aa^1yFanFk#qBL*H^K;u(g zZ-1m#=L5(vYjNIRv^=m4BMT423t2t|M-4nEM0zWad%T?tdee-^b@_lD)$-t7DUt2^K-C##y?L^c z2V+Urm0TTC)-;gyalbsU^)^u+G=zu@Jh%`e$_#Tvf(LIu9*%Sg_~pSSOZ{_>2X-$z znQ*qr2MvzgbKCHWjUKIeWBmtnlLr-EHS%B_W+OwnOT0@U7+OnD4Y_#GL(E3?Jh071 zqCCiZV*AaQ_z88#eTm0JdC*_}c^6ehiu$35OD3VOdvjz-r9?5LIpn;l2()(5K2C~J`^MjlKcSyym%2p)8O z6=dx~-bU94?5%cvVC!w7Jh&MmGVq`XMwHo)BN9A#r%O2U%;gx7YkeRi(ytF9mip%$ z5A0t1@&1%w?z?_kqupy3ztQ8Ct_8Q`CJ!!}YUII0%tnTCm-sW62Se-VsUd|2F#70u zV4Dq<2f9D=t~+1UYL>VXR_UGXJFox}<-v2=rNj84Rtzn!>>N#QK24 z(DJ}Gj4V75FX?z295wKu80oD%?y>%A(0ds<>VpUGJ9^vkK-C##O_^ro!6cIPO|A|p z>oSnFKY8ne2e#g-Jn+-67*R8b$iRb(F`~>q9FgF``u^ca_lg*iA0BMA)IaBVVD|!y z4=yVHzx9Rc>{~lw){xmLHJ9fm4~9=S^57NBMuu{ic=w9I&<1*H$i;)6Vm7Mhfo(Pt z<-y~vSD(YgFS}>&COjs}gK#!^;5VzxgV!M=1|Afr@#%JNe{6uqqk43sj*s#HGtv_T z(DGm#$^%=xiFIZCpw^!ZK(^*?d#ha^*m|2N4;Dj21|F2ah%$R}M1lt!UkFEf-mCCHMx91rYX zS8?IUR}a5fzJAMz`O{Ly1%57-n>;8p$H;@%FdG>^ayCSL^==&uy+=~Sv3QIH50}fmhA&jZ; zE!^E3O=MphF`Wi3&D;#4zpSw*oKjX2jX=VYrs(h53V4+mB&3c*9E;# zlcPR(uwCk4%L7$sl=YUmMjp%{S?6(eh<@#J8f2YC-bT+Cadl{UVC${Q13&$W5w(Db z4C{j{F`~>a9FeH^&9lOhzT%Ge_Rd0*N1zmS1mg1h%u@fFIrQg*s|4&`SFyIr;c2~} zx@Y353qMUcboajAxyggH*Nr@wiP^|dZWHg@I~a=4Q$sEu^cJ%t{rbQ*8;SCu(15>J zVB#l_`hgx)N|XnKvdII#S!Eu~f{Yk=a21VDmA(BDf#;*1U8(Q@GtwJ`(DHyTufPxZ zT_30lquQPg+x#SiVc@|m8n~4Aa6Y>-7~0ZA;Q@!C<$-M&S$H5`S5ab~kq1|k-pcbH zTbhI;{R$~OU`Ms$0ttqk^IL>9HY&2Qd2Rd0?B3M0wD5!`ZJe@gH{WPV0n3 zc`!JeJn)-U=E1Fy5d#mdq4BArw?E#8=cD?6OdTIxA8^NOdGNW@AO6+{s>0Gt^ne4` zD-ec(2XkrQQr^Sa|Knh2>thrK#wV^Ha2Q%1*oKjX2jX=V?}DR-^})5IxAMHl*2lt; z=Sq{K(e(j4s^!5Kj^1|HlU1Ej);bG~Jb0aCoypZ9c<@|lko6t%Ho89OBWDX*9@u)D zC=Z^5hzvX^g%M>w#SsY}Y<&mxpMw#(cz_Z0fwIxA4|ZGX?~e!eudDDreV~6`#f=O0 z?fUPf25E0zTYO8I%O?eMlLtc=8F?@dvyq|PCjQ)5C-Z`If(wRfP7uWd>Xj6aTsFY z3LgrFKIlwg40d?HVQ61hVH*bWfQtnk5|1BTz1WC@G98D*W zqAd`S0S9FEC~#NXR~s*z@^{zg zzTaKs$K1rhcT0>oScuukQ0@{R@OCit5j{2J!a-jNXDtqFv%xsv%LH6s{52mL2kPa6 zzfZij5);3*)Qn?zOmunhd^VQ{ezVFr$g|XlgX?H~D(~%&kKpmBfqyDEz>M?-0kq45 zeJBrXeoq&v3JWW)kJ#poAq>OvU=a;m%4;|W{t1QEkHWzC#PWc{&@K;b!%&w8RmJNn z`huf|t8hNk;vyq|PB|hl0VCWNi zYDnP$j6V9)MYh>cd2ndIzst#&%()q=J`nhOs2U?~k;%4;~EF9L-%+%FGo!^pw| z@w$o#IBMWQdD2^X+~bqsp!ZXLdGL*t$d(7H&M0e*Wkw#nL9)KW)ggHB{8J$7LBBk( z^;YG9pMJ%NnnOf}^+5%UD6=(3BzW-2LD2sPjL3DmND@xZgKsVM&p94=PZ%`;fB3JN zRfEqT?AZuTxCa7xYFygvnMSG0Cfu;I+OnAg4(8_iV9;_S58lLVWGHuuKmS88w4I(B za`E6 zeZXO8*9W#?WZ{80Uv$X|BM)vOy_Ls3wod@P2a==F^#MDoT_1cWC9>s#sx!(u3cNL} z50;ax6S+DB4~7f`Sx=C+(e(j)t6d-1dYdQ@7D7Y@9^8x(Wj@Ri2_9@e0s8-k5xICE zBhvHWpr!sf#{;|9Ra|l8x9_gREh7(BU^X(8yTph57Yyy7 zr-l?B!04mrfo(Pt<-s49o%jzEAMV-zT|6ergQ3~vf#0k$4}OD;7kP!n9D$)3KwYNWZ!Q)XcG^37>@<3)p zzdksE^1$Yo2dcutit8f|Tz^3rhV{WJ8n~4AaK6wC3Tr8a5#<4gpOk-|xI;*{aHiZxV(QWO#I1O)xvm8ln2AJ$pgPxWggtI*2sgZG(KJ7 z?T;_u@u+lhUrv+8D>YqURtY0}pP)h%%dSM1lvqON1jM?(xfm zqn7&T91rYXSJ7zmv~orNs$F#QozE8QHR|xH+~mQsbw(b%gW1SX?h+qyPcXEHo*HuT z;5kWWEe~w7q4J>gvy15QWUe

UePW*4r9j;>SHWwH_W5<-rTtNGxG=IxI?@Oae7A=L3v9$-eE0|B(x59szQ_yNB>P!&d%JsY<9t?P|ESVsew@*d8S zL!hv>Dm>sYv^=m4BMT42>na`wM-4ovL3%5Xd+gZ?dha7gqw529RLg_oQY2d*s5+yp z+rV4H`d~fD`XX0{;K9g!!O)kb$=m4qfW6h8FS7Mk<$<4m#fXkTLWs1$d)LT=cS+V^TpglcU-~T=+E>vp4{W_nlm}HIA_EWZz=$#%azvuu_f-r> zMtAqigWoLmubD%ytEg)Ex{B&E+g7MEtntqiuYa|1?JxIynwvbhe3Ov}n=l(0%5CDK zy9Y!2>Fk7y2VpTA)$_nM8;SCu`N{nYF!7_W`tx->Cdz~KZ1TWwR+$HNAtQ$MK`k1e zih28EKRh2bX1T%x%m|(_)2imj9*EafYy(FPJh+qeR-X6R|6MpTHa|HUT_3Qc+Vw%El*pC`s?I2D z=shD3Hj}JrTpfZ3WAg_?Ux`2V99J5scYyvc zDm;)8>DLFREcMSh9@xFEV!~f}mVPj%(FenN&6rW==@Qd&lLx&v8+j1HY-A|6iI06T z82XwX8&Y@xqmP~kw%JIO2UBmTR0J5M4M6`H3J)+MI3u9v!5^0T`{RNA z>ngl=o9bUzQRd{rKcBrf_0diDG=}VCY+VY{9lznb^v{4-TJ);EGdFQiZJQAXA7VB#l)Ju$O|J9|kN4pVw>9ttlLwEd@T~|6d9|Z(6@od;Fgx zv$;I*n^nd^Z^(#Yd2la{PX)aF@f|!K_3~-z_$UrABLg7-?egGn3=cNHI8YT9R$L#k z%{M?8Q{j8KyEl3H;3FEil-F>+d^#99D9*xQeByKwhoL=PWE+OMJg6pKSMeh_YT!YA z(p!1l<6!=9WKu(g2kfYp2meSNY ziSpp3Z1TWwR+$I+J~8s(ej1;Wy!~+)9*>$LZYYed4`fF4>w|MnfB55ps<1Q@J>bA~ zKZJp61Ki!4Tp#S9flGN0=akaH(2-IK4>%0%`oK1fEIbgetLOoa8hFr%^j04CI8qAq z?yvBG9o6!H|1gy8`asngWjz4i8hEgiWbMh-A$TyQKgcRxt`X${d#mMvt+$Et;C~R2 zfd?UsC^Lm45gVEXKf#0k$4@zw}^56mL54s%_dqnid5Ab-@v=kbjeDEOI=?{NA zP!&d%JsS>O?I8>U4?f2*Rx0n|oR$&{{dfz7fw776MLck6d0-nx79NP}2P45z0}mRb zqo#yLgfd^lZtlfC@6g-$V4rCok-bQ&a zSj^w_*AHyHO_T>0eP-lA6RP*yI3iK+KaLDXUMq?bxvn2zM1xH{$ZM&8&hfzRbrr+v z7vH{PVg0}7KQ{0EVfVhWBR6?)9I`PKbi&=e;WRF(&xqZajSS^3@z;t5LqE||L$37! zXG44az&0C+@}TX(ReLd#?xnA4iN{2FFeaNk@S9ak0Cs$l9Y!8BrT+NW+aEu{<5ANa zQ^!YnATy$0ALMiT!ygY+g;8bChG9GmVHkL@hXyX?J)F}U2SY#KPGLlOz+q^4U>imj z9*Eaf%mhabJa`ZtJ*7PE@$>DV_X2V>$^&*(%Y*!m-gZ1tbw*i}b{cu`CCS=_t3&W$ z`T~%3GI{Ie0gRq{9@u)DC=W_OM27W2GphG09FgF`&y&NE8P{V(et1y8QvaOef!*sW z)}1QbXzDk$8xOtwTzGNEy4!P;2gP<7d9W9=k)hlrKI8ge=qNokS5-r9AF&>^{(Y zBRT4W2NyVc+wnlv8D+ijb0ZJ-ldK)NIs^}9ZUk9hCvT%XcwWq=^*pfkHc=kj2oV{0 z(1PmyR*p#U;MnWo$gDdtA{P%ZBK$G!`JzIW`sW-E>|R%KRYvj`m;YIB$l9?#{rl&8 zTleH94=(<~$b+vi8yU)7;BUQPv{6jXd~y$z2D3c2_F2iA{?1Rh2n1@yK+A)oj^1`W zP<2LGuldr*gYQVzc3d5zU*{eNS;cB5$^-N^4YH=ao^0!_$^$?BiV@X@hzvYvP4!-Z zBNFxg>&9^8^)9Htiw80y{raGorT#g`gOotUK%YQ=*m2WcPfq{!pGJRwb>G+puMRIX zcI8{0a+3#@_ZoR{5VMh?+$R2dmtg2OdTPkU1I~taePEl7M0v0%sr7BB_N1vF9>!y$ zJeZJ89{9~F^Pm-E#K42cs6T%5_Q!AVeAGPgp6KZMfID9M{K3UefB55psxYeT*|5#0 zK^O)e9HN0sc@O8jrNPk2ZZynde1ZoYhIV~m8%7o$h}TuT2aXze@HjepN_pPnWVdi+ zKK;R1*XvE$Q7sROJ9^vkK-C##y^Jh@FlHk|xlMfj&|v5kJvQWr2e#Qrlm|DRyXavYor=BxUSB*W%7cm7s#oPy`07DQ+u^}&M@PJj60fvPa7?Ab7ksSt*N2S;e&Qr^S4AOeLo zK;gjt6CUx;|iUwLGx(Hc=kbhlmV3Xh-#4mLn28IJFn_ zpNbK=)(0{o{rccCOa1-v!2Wd=-n)zR>w}N_pZoav_4S&+@a6Xne|ogs)ZFAj)vt{_ z_z|;_q1-0EaB490J3Th!;sIwvyFReZ2J?WQf9Lflf6YhT>ndI-IXoFhryb?$;esq- z9&F6!>ni+a6^j)+z9nSDz=J2LKaP6)<9B#IYSDh`_$Uv!ys<1cfo!Ss!p1+SgUshJiew%8>4e+l$@>KMgo& zkA9v~9{2ctL^!heR`Sya4oW(5+u=Z!nQ-up5eGk$sto!(T^`tmp)L<@6R)dy z9~?FC;AzrZdEDd7E8)n}`s8So2k7Wf&_TOAxXRJnjt8pFDCU;%9mB0Jn7ju&bw|-~j!7rGN4COBIrQ3p`zv!tU7Y{fa z+U0?5HWKB*Gmlok5=W=)1Aj=xW1>8mluaJ^%_{TYA;^e<2c4)t4tx9KFL*raO*(;h zHp&C;cz4=DTI!#3Jg|FRMc@Da*X{QT_nldnXGH$84W1aC zn>?s^$jF1=FdG@lUE*(k8w~wJPYwCufo(Pt<-wPCeo2GVk*=9l@RLM&@Jcp$;5Vzx zgO-pH0}r}Ve;oAo$3O6R)bb#8ybm6fa{9v`4^)LoZubWqxMn~Y1|FQGflGN0=kg#F z7M%v5`M6jg43pDtEe~wN$if5hx{A%{k1tCG$vLzLNRl8bStTrCk%cCTC`l0zxu{?O926Ip90Ww7 z1VIrM71MQ$5qQR#`QDclvvKo4xOQ^UnW&>YU$H zcU7&D2N%iKc6@X&9xQ*^YI8HUzyltwbbg>4tydnj1VsuSJWu`?N#hd>oP7)X8#+dXb=1ivRzprPkQ+;1rl?sojvSZa2Zk_=*mdP1NJ`o3IwX)!As<~u-zkV2l&k%Y=wBh1C{cilH<1?4@95Q)+c{e z^58GBwG|&7j0Y);tv0tS2t44?N_n6gtydn51VsuSyiEQV;EEUzZddU6SC*p=)Z6*u z5L6_eA5_-#KjV0ycU;AXfyQaSEN!uJcJ6Fj``209Dw;ePc3R1UYnY8>VU_sGa+V!K zyM_cFU~Nd}2fEqt%7bD<#?`{^)bw~YAKtz4V0MH&FwH9G!6L|rf(Nfqef;3656Fhk zzp9rh52`rzVa5Z|VRYGbVdFXtG88XmPxwWvwpNb2LAJ*8(ZP7IYMo_gx}TyA z%@6*S2fERE<-t5qq~O62@;@(EL_7dBKL6_as3>fH@UJ|ms_B2m@j&mmic5ElE*e{) z$%Xm5w+?>lfjP^f$%8k4Q}W;@W+PcxCBC}8WyjL4p)ekdX5U8TJkZUCR~{6a@Cqa} zCT3@)H_PJPD-Y&G$OF@?;$X#!Uj-Ra@L(v_#{qYJ#KQKdHLp^|hvo;Ek(&t6h zocb{1f#@*0?7C3Kb&#Rp!7XZB!a1C4UWI{mf@GjR_PmJ8kj@WuWu)T)JFeocvq~Pk zN`AYydq9xj_qP;ihzC4S>HMI&tNf51q2Y-{T&G_hGJXrIsWoK?g(S~@y zqm|ANbffjkgU>*bf(JhGKQ~vzc#ye~&%d@EDhlI4P?3CoP(#!IjN^gcaTQk%-z;43 zdfTK4)zAK(|MT3ZqsfCs=af81!)zoc@ocd1wYHsQXQ5p~0uP}3$a$cf4X-@7e4zU- z>`oJI*QGy{;*|$;BjkZ;Ryhy8f{ZA5FpTPBAI}J@k1Vh~YTZ<-cmp2X>(qxC4@8Gu zEWlr|apnD8$%EU}xP)^!*G+|i6(AX?Pm>3_GScyY9am8o0#!UOdX4;cZ})&8!SB-) zr~waZI)3Z%K=c`HT>;U`c`!bPY;D3v2dme0r!6~cYl_x@2fERE<-q|^q~O8piEGt$qIW&!8d`9^9wtf5!1Z@3@M0?mX|mTBr5*@7{X+&I7B?*NG+%w*8^v!T3y= zjbve&`1)roI~(m93gf{T_H9(o1Kn(R<-wr7rC!CRbnh2QWAW~l2k%741JkT>9-M=W zD0ncO>SK?)KC;37s0~Z0;zK;ZjEn&Tr1OLOo%%52f#@*0?7FaV)jF@@!T4BeT*5h= z8a{T>h`_{~;uhIqgOmCg?yaQxQe zf#@^Zx)Y*R@E|kU+K`V9#)A!MmYw}^fd@QV>HI)9TCY5~0E!emNF@KWaz%^>*&p}$ zHx3tg5L6_eAJo$HKjV0ycU;Av2M*23GppI_6NcVD;(@(W{)i?I&RtOQAPZ(ASy(2% zakypYplw3}51{+Vd7zsO&VwzRFP1Ae^iU?gUV;D4@3Q@9pRakaGj^v99pi@K-762~ zMaTowtm0tBiZ2{c@?Zqj$4+;BJ z=h4PzrN$+k!}-M~%g)LE>Zbt@bY-OD0Xwc@ECj0H!ASDkz25_Z^!YaxA-@fHP{;9G zj|Za9XzLY-R>6a8Wb1=`bTA%lDgw6lHRXYBw44XLE=}qc6&1Uvpq^77W;_rb zMweX|mHB1WaTVipP~&=<%V3S`%Y&AkyBNtB?kaN_STWM$Ds*Ka5BOlgaM|nR<`Aa> z2cyYu_jV76(dXY>RlotaTRJ_c@7S$}1JP!5H3gzo;2q3=BnW8O9Bpfw9@H; zZnPW+yev)16%`!@MT+Uc7*rIv%@r{mvKfzl6-^u*xT3^CF3d) zTr`dWT8@JUo%%4tf#@*0?7C1!vp<#7gWS}(gkw0joU`macasd%#~v4GS*JDA3UKfCnn&!9$MUdOQ$)Mq7V{XcauTgKVwM zM+c*vZvX0G(O(=olg%k2U}5M@V>9*k`wsP8J*t$zidxl5Frmt zvx+`peH8sm$%6^hpZxCn$P3$}w#HJ$yLo_(RQmd$p;I4bJP;j5w_O*?=ngXQQ4#)x zU%|&kd8u&;$8c_qwd{QNkqiSK=*mdP19n`+7zk9sgNfv~d%Fh&34XH&@&-I;Lr zkSPxuYx}#BSexRETuRO>$@|B+0fV#EMR0r=~=LZWTVc7*53OwL4r1Jw^ z8R>Yyj;lz6KovZAll&I8dlYC0eh;KTLp>viEj^Bc0t-TB=7*bkDLd( z+3?DPCl1C=$L{p)5Zh&q`q=X#-ngVZ(3O#n2kf|tMi8ii2h+%J zVY^461n_&TDG!=Ee(Ui-^cihUfoK)ai;9q~)%fUOJotJn*vb~48Sp?iTCY4f2#ORu zcncK;E^|eU2ZfgU{5!Iv|6x3sz`p;;dC)@B|BT~--f|&RrjcVSCg!@d6Km8IjKq;+^_1K| z@+tK7fnV7t)_Xi~~8_B{d@tt>Cc2PE4>*sup3yv@O{6IGwUU{&yXp6(> z>Zo}M_`Je14;Dwr1JkT>9y|gWQSe|U^{3VD`X~z9qjvS6iVwX%;1w@@UewB|4>KN! z4x`Ji3mex0kb(YF4#NJo!S@Fxsc{MCaPI11*~R*hj1UhdvM(C)_sP04((!<;FZv1s zRq$XI`7LbsDAou3UPXb1o)=-D6G5qz2MLbfdOQ$)Mq3}wlvl-rQek0uX>#434E z8nclstP$(uA#8`0ndi?eX?#gyz-#S;gLHbQ85E9Hu@FsUgrnzMaTowtl|j6 zieC&FQSe|6X5?auyFQA;_NYCtP{oIMz$;$LgEmfmnDIb#7+rQ=G}M4AjS-7jYTV`GKyCbUa|kRg}%FTiEVV;zjU#7X@m-1KaUij|Za9 zXzL7!Rxv-glWZ-|M+f7`t9)Ht&XauRM4^LLQiAmGj^NWJJM(dDNdi=NV!3 zQ3|$4eLG3u0cK>`%aHOw zS4KJ>u;VHQL76a^Wb0jg zbg+8;_5|2^MBo9BRyse>jn*p<@@G@>U;!!$oaTyxO6vl&~BKiEFgQou( z#{<3NDiZ7y<+A+HyyT>oeWtE^`0e7+?aiSK*bvMt&*B=7*bkDLd( z+3?DPIk%cs!0xmyw$wLx_sWAM5%Rz^tDFb*AtMSNETsPQsk=Tb*dMk3JyRZZbn3&5 z2cpC1vg^XeH4S7a<_G1eaS7*e?tc#k7Q-6qWAg*vxTHMLm647I?6``J5U7F&?~>ob zeh+IB_S_wdd8Foy3u;&!Aqb>F+W&@ ziUKFOBE|#jjL-j_PvF61_WeiBgGV*}&p00F9ar)0^sP_UE0nNt&C6q^#-B-O5ltQp z&#B}=1!=SS;fJM75^b*M8Si_)So_f*GC!HA9Y~8z=L2$u;VJKL!b&CyhnZu`#s9c@%axH zpg==B;DJi#2ah>^>+wMJnMMahtC$~DB3n!H(ZP6dumITlCq)~2Uc{r7&JT2>6?tG% zuc&AzC{pm?eN+@U&J{5pl=&0 z#?2qwd%*q69ytG8GXh7W#R{?S$0|4He|vB-E43k@cr+6eDUA;o%0|z z*oqQ^_c2YU{Eh#dJnhv>c=yVKXCmZ*X;yKtVtv?<5d{yHP=8wLu8*>?KkEB^RPmwr z2fX5?&x;;+>cfl&qQmI2>p~eHfef@Bf5I<%pFClF6>3~@Tn1}g-|vHg^#REk?#vI~ zWM4Go$5rUcKpybHf)TOT2R}lb3LJbub_?4*%6{PU|4@nI4B-Idd=oxaii0N{yY+A& z+KjGt%%jA?J>+UJx2r!?vg~qfvtkGbJX$FZbfe`s;ALr2uBd1jC{o~HDJlva<%$>% z%Ef~Jw174Y2SG)09CX$6-wX%(uaoO)9#^q+PTc_=v$Z_>!G8~DZ#J#Z3(>^E$h=A% zRK;v03#-I`SZdkjY1dE~4tO@CuakAN!EwN+0epP%-}#;6K-`}E(ZL;Mu-dzANGXYT zuQ*s5DGm&?%5m^HWJH0352-)B@2-#Xus!O>(*h27#Y=I}&8ZJF9Ec91%dQK{yh%Rg z^q?9wF5wu?A5X);N+B7jk3BBpGNjW3T^Zu^pe{SEVkiWv;K4`ax3Jx#e2UM1h$ zfCt?jzx8+^`i!<_%CF=>b+WZEA03RchZ;K9eJ zC~$-;Vm!DzANaos6`Am$ho=7-#{<3ND(3(Cb))lHo8LKO+?D6Ho*UIQnmo9#fRYC_ zFdNCjD)B>`EV}~j8VcjV6!z^%{`x>S8(w*E_r;l|uscnAVDxUhd*#805%Rz^tDFbV zLPiukSVsM6k-I)B!1k!aX#x*0BU8WtDGz!&^yd7vvJ9S_)X6*nMI1rI(UzlH4{6*l|)M;@g>Lph4?QlL`fohw<3_!YK<~JU+}|zfJ?ZJzkA3t+*{QcCAB*borqhZlc~A?pku0nd z|LJ$ju0p$p!g#>5A$?w?n+>l#Xfm#18g{4WMtlZ?$U6@{j*thYS>-%f2N_ZDUHMINQy*qL5FJLBT^Ba4yNW4!P@5W;a1Q6OYA~=4lMK|S z$pc*(>3G17t9S$gRq!C0{1&!*R5=WOCsCjVJm~BAt;Yk=XSDSTh*t4BxenQyn~x60 zgJVgSeNP>V)_@1P(R$^MK(#HlIAPUz0i?ZrfEQn)8GI7FY71E@mTHSS9{*X3MThyN1GeFpYhUlg|%yv*DEo z<3=_cfZZwIdmFmr-Rt~dS%f?=%_`?XObI0qR#JbO?XHiius!N{Q>yq74=^LszyK)^ z`Z@Js#skq|blG)b<9Y;SDCP(CsBsDBa2{_81B<-|3Gsl-kj@WuWu)T)JFa3N1ghY{ zD)L*{?ostL_&rzP0S{C^~!_mph&@k)u<@2mn&jCsMgfy|D~kBgP;a=YeiEyz*dAjsx`m;Ef_5 ztj8|pl?R_h$OF@?avl^erR2dH>Q6J=^-&$RN1b@Wln4KD>cfl&qQfp0;4j#?o&gyO z9y~~mOE`z~#1k;Eu8<4^9_Y$Q#{+g;#Uuz+!GpErx3Jx#`W5hdg((jPIDYH#K=c`H zy#&!Jc<>O}nw5_Z#)A_pEW1WKiq?P!y3u;&LH^Q89;`z}fn8h?<3WvfKL1I!z_GV8 zk$j7N|B>_HIZgjFjtA}qr|qCr{^|Il_+{TcQM+yHvkMw$jbAwK-Nb0};1*03s z;TOL4%k=X2hcO$;!Yc8T_gVJ6v}-7g2bhhwR6NklhRB0OWj-<5e$b)DYeP}V@~kue zFFg1(LLQiA6%&9JU&d1MU_JGxx7_t{FKmxGHAvt=FeCE$!ShainDIb#IDFjDzfneS zkfGo~Luy>YIh>~kS$54#0uQ(h>HI)fMmip_^`;XbPz4V*kl(^~kD8gl@2>?O@Ia;W zgBKjX^>`rqjJ5_KS_Kapk*%?ObTA&A`WkHQF7SXyE1e(cMl15bq+U@`fjgBv*ocY( zJGdgogPPra{$E?7qOj*hK}B*N4Ak^L<9MKVTt%^$C-q;%n+>l#cro+Ui`bRAKQW~M-o4HbK8uhCrdj1Y zs8UABgDH6;k2*b$Dn9hQh*!MydC?%JKFoL^I*cy6E-dr@AVa}}Ce*lu zb2v|rv+Voxk_^>k9>h_--sYo&)$8eFU~7MhHZ(t&&c46JNO_WP1li;vBhH2u#w9_SrcF{H=tA$>13KbF{|;o%(f zw!}x12Sv&%dC-)`m#|FyOi#;xfOZXq@qlMT`aW4V8(w*E<&!PdaRfZQ=hv_C?v)42 zBjkZ;R&lUm#Xk%gQM^yyO#Nw+yFMO({ZYRyq>2ymAea&P{NQD$KFoL^I*cy6E|f79 zWGHyh3}vJU=WzbE(6VclA{ikba2Zk_=*mdP19n`+8VFRugDvE@u-~IrDe(I$1sdW3 z4^+y7R~*0fcp&J?s(Ykp6-BZp3-Dth?pb02ayg%@x zqChHF#CT9^h|hm^Fe)cfl&qQmI2>%zvh5@aZN5RWoagmXC0t+wnsl}UyH4|HXu z;{iLa;ztNn!Go>jx3J%%PGz6}_dFD6hzD=8@2B$p$wM8#^>`rqjJDRhTgii#RIk_h z=wLkfJrCGAilPni0Hb{yvL>A$=tk?62c1EYf(P4BQD8Gy#CT9=6!=en05psTK}GWU z!K<47oAE&ZxC-~vBKdI@$EW_~A3n83(;02@PTsjPp-(h!U90kNSfx+z;`9SG@Fjk4{W=<$8I7q-~ldrm6JzpMNoo0#y z-Do)ucv+g1D=KOTiWE5b8Wjb;;EEUy>P-Xx-$O+vICxFde={8DA6HRN^SFvW_w1#j3k-`HmBK_sWCh2zg+dRnCLEAtMSN?4tgZ=&p|kVSCiY8&vTj9t1NYe|?bX z)Q1@lM2FF3*M(*NEXYvspdHFc5su-!c*C+EYD+RgJm4~*V%SuK_+f7!NMB2V0j>v~C_i z_mn>_(v8+D5AL`}$%8$pD6obrVmx?g8Th{s6`AmWFQNQ59%md6^p2~jF=hDGy_Z{D zc(34;Q!Qd!&Wk1w&OkO4%ZobD_!3r$U)pEc57Vxpu=&Bi@<2BmUU^WY!dI2BJN5nU zRuQ~=JTT2F=RwY@N*?T`{`9)LJ|2ecQCA93#T)P-$>~pKJP;j5mt7Y&E*oSh zc+e4LqzLD5UMXPN4ZD#H10LwgNXG+qT*XTesDcOIlHbC1kA~gA?|u}h0S`twe(Ui- z^cij42hl2c(245x4?a2=53ckBTh~&wAs))a0)V_m>=w?{^WDlMgO; z##N=dk_VkpMv8C_=he!V-S}C72V919exNHO9S_)X6>T6;1rNR>zlH4{jh_X-X+vh% z@uoab>HJ`<t#1@!;wkVC%Mj-~n_`IS+KBf&NCxU-Jm4~< zJkXVqjtA_xifRz3f(M7lZ(+Mfvn25QQwlW110JZ92a_GY^>`rqjJD2%Xcau@PW5_{ zj}FFz8=r!$$0*v+^CBMYYvHT5vc=?bR&D7<>y-zqK#_t6hfz^r8CS%3(CnDcf3rF& z3VU7@R3u++`lhD;8OH;?<0=-cJ=>D_-RaWynE%rnh1GdnpMt&ZIBTK4~|fO8sx5z7O*|) z)^k+xq4@!?ceJ+bu8ed% zV8>P52Z1Vh@L%#<*zVC{D)_yX0yW^lRL5^U9*91pt#ct-1rMI2dOglZ2jju5tzau1 z4xJX_!EE+zT0TF}jn*p<)_@`f4}L;Lfe*PN#)B5W`}}`56L^4%pxEU+n5OA}#__lXvWjtGUL`9-1|pJeXEX$%Ch8eBH&f!N%9$%`CemJ*^Jo0ndhX zexRETuROTX`)_@ZaK3_!azfIK5Ctif|5R+9()U^93Go8PfTI zu8ed%VEYeB)mHN082K%1_h>mE{5~S^fCnm_A53@r*5iTbGuk=|qE+zVX{y(wd~~pS zO*;a%UZ-f?JiyYB&JT2>^~!@qph&@kpHWd@30D*x@7I0)+g(k0@V2J^8OH;?<0|S6 zopt)R>1}HycFA6%*7?qzqsfCYb(B2lP2)>gCVsoCWw)YTLnb`X&4yPVw4b)VIX0j- zSA0DU?_PPZE*Ec)*UUC{S0)gI~yRVZTSKkHPOt z6liFEzyp=?V5Z}@9uGvH(bmBbt%3)Asa}up(Lp?bNG&@d8$}!9!5sE&TFwLAXua}a zIw(@`-~=iPEar+B4-&HZQZumw_j@}71r@=Flg|%kY5JdWJkUF?;%v*SpI`ho?%;+2 zt)4r&t6WsKCl9Kp|&N(Rz(9HFHjZ2Ru+I z59T<2>+wMJ8Et*CzLE#eQoa7jM+f6U=A4$@rqDm|0P`cAALvHwl?ShbA_WhAMMZ&y zToL0zn?m6KcvKYj{(yI&df{(Gvcek?e$CbN-;4+P$5psz2lC@8;&&eIeBx+}O_O5o zedNtUi*iMCe$csrk_Y{1e7Tp2LnbWSrfoweJkZUC!-L;1xYwHof9Lz+`FhjXV7e27 z_k5Q+-@<=3s`OYnynE%rvk~&ZG^?BkLm(px9-OBB)W=;Pc3WR+mK{{_q4@#tPtx}X z?>O~g#skq|blG)b<5~|g(0cp{zk0b`N{2FEwi!iZe7l;C4%KFwe1D4+o;n=xXx^l{grH(Iy{s zyPCC(Ww*VHq76+C=CUu-avbPJ>);@Qaz#bGK#>9mzoDYQJg$i0pzU4Y|3Xw0h67YI zS2aDDuj#)T4)l+!sIPfkMf{O^=YB34pL_K6^Ck1PZ!$HSIB4*Y5(m%G_;RljhfG*@ zJK8lAh6A1r>GVK18x9U4+!V#aUurhCfFy*2U`FKAg9T1~nBhQl7+rQ~CucPT^L*zl(E}zn0!{OUq_?=G=Xzv-cqr_lK`nu5ep7_r;M~9{0-760^M#uxx zta2W7hKwk9@CWs$p6>eS@T@O2$5rZ220U2g)Q1@lM2FF3*M((12V^LCFo*`0`xs7; z00ZkN$v}PV^#N~OQXc5aNXG+qT*Z0_RKbJu4g>Jb008-OEP@<3Y|gmfevZw&b24z_)4n{6IHakq0LAii+xjA_WgFprXJ` zu88rVV*~JiH+7)i&OmwR-{uGJY5JdWJkUF?VpioZPvl=>FIqNc=G`3zEsW~&q8yEt zJa~!5mwS~sWWusL4W?{_c!1e>2XZ5wALwSoD-R~7?#Y7P>0+JU8}ROx2VX?U1JkT> z9@K!0D0mQ{{?yG~ADssKQgi2_{uJUtFeCE$!TU~qnDIb#7+rQbYog@AD`e{~J~|i=a`(3EN8>5l5D$2?()odIv|f2o4HPMOa0wL!rgKG%2am>s z|0hvV*z=;GBKhm&4>bMHI3DO7S5bOz_HU|owU;LjTRI@|o3yskoFC+fQ}SRijW72q zama*accxuKVb6-&q2Qs4I!DZ@C zkGt!mbCNGL&)rn<20U2m)Q1@lM2B50z+bR&4Fnkq9t@#@6h3y`luYupgC{P0)eCYVC#{j#VRC;XzfGAqXqC0lp! z(ZP6-XP9L_)`_Au;DK(mUU`tesgehOqN2c5u88sAu}aQx{RHhAGU0)4HoWp6=d)dZ z#qKnGeVsvg_sWCK5%Rz^tDFa~Lq-(ygX`3vI=buQiTS?N0v)L04S4XWQy*qL5FJLB zT^Ba4Js?BDgV$+bxzFJQ36|ZJ$~^3SGH+Z`9_Y$Q#{+g;#dQc&!Gjy*x3Jx#YeDe) zBY_9=**7BjpTqgg@mr4vqR(h+|9B-2hLf$Sd~`4#6!-{ieO}-JMhjy_{{BEWTCY5q z1d0?qxQU7a6SyMAgRal}QVUiQco0-1=fQGK|1*vUddF4t?f2uD9L-yv9#tt<>7N>W zbt#%W7|~M6gEwe=39G~lRD-X6r z$OF@?avm&&j3{_;i~3VLcYSn&?NNp34S!mQ2fX5?%S}Ib>cfl&qQfp0;4j#?E`baM z4-#o$xzFJQ36|ZRE#pLe?0qtqA?1OtjC4F;$5oVkM9G7{$!}r1NB1(|H~oFUu;Wd6 zpwjul3de6f9*91ptz#it#q**OWb0-=Iv5WMZ3bJ})2-0_fJZBxALvHwl?O{ek%9+l zs3@IW^kUU@Kh_V+JiQ~JDpvHuGX{1NiNG^?BkD z)P`q-)khE59#tffz5yEWAjPQ|&M(X$%({R0IWdR~Nq;zUErgO!fodOQ$)Mq5Wh zvN`cqHz-l{G#t z()x?d!=lN95v`Rx7>(IjAuJOw`j}-uxs|ff&sDZi4f6Fxy4mo`gR RYg~C_PDSM z?_TEzsS)zPG^;pRvEtu{jL3PA5KH~3mAgKkg#A&)W>Lk5c)%-OIzL$L)Q1@lM2FF3 z*M&09feZx?#!%yOpTh|fEc>bYB*V=EY_n1x=*mdP1GXP6UmGP4GLzrJevhZ>gWu;V zPy-&Uas1Zff#@^ZIs~Fs@L(+2x}J{?#)D$#!PXfRtpN{oqxH&znV?9)gDj{hFoG*$ zJa}q`FSR&50W;yjT222mjt6?jRUF+n``rFKO&gE+&ytptetvCNGmfef}u{r}D=w?IY!Bbbv_8;^+(PcfP(pJfXY~;7F-{a{PzSNTJ#dnAY80bRqK{`KJ@A$391JP%+bpS-G z;K2m4bqyaKj0YvNf~|`M9`I9 z4}yy1^MehV{+sbY|F{Y_4dlmFEH5}LA*NB|1EY(d+HmQ?xdWrggJJEIJeY{tSRpJE zFFD$>d(*a|u;)cQ8`Ad&y4i4e5ZwRnj4#dOD(c_->lSvWKXP5g{WhL?&_6;Rm}Zsp z;9bawf(JRMKQ(jLM{n34Rf_!qtkC>`SG;t7u+gaxGaiTzqsy)f%ls_JKosLo_!T^^ zViGm3V_XJnT&1>IcAt*axQ06uPcB1xT!pR-#O;{0YBk zoYYFlMgBX0V>sxu9Q=PLF@J1KT4iUP>_i+_hflnCDpSk^_$d4dzvvTROUO;1C@dHY zej)%S4ZcjWCzace2LazKd;x2gu=9{M1vC1{A$3NxKo}TVoinP)#=l9~J11oC9mw8a zl)X@7zf@kf{WyGRy2ye7#h6Cc2qIHt;STa_6^|^Kg})#RC)`=sj*TDvHdk3KQ^A3w1`cy)dC z4A1M;KUJSNeky)q%6out +# @TEST-EXEC: btest-diff weird.log +# @TEST-EXEC: btest-diff out + +@load base/protocols/smb + +redef SMB::max_pending_messages = 20; + +event smb2_discarded_messages_state(c: connection, request: string) &priority=10 + { + print "smb2_discarded_messages_state before", request, |c$smb_state$pending_cmds|; + } + +event smb2_discarded_messages_state(c: connection, request: string) &priority=-10 + { + print "smb2_discarded_messages_state after", request, |c$smb_state$pending_cmds|; + } From 042aa1383ba1681a38ac12516eb4a30cda7a1e7f Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 3 May 2023 10:58:37 +0200 Subject: [PATCH 3/3] NEWS: Add entry about SMB::max_pending_messages and state discarding --- NEWS | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/NEWS b/NEWS index 806a43eac4..aa4f4a14d2 100644 --- a/NEWS +++ b/NEWS @@ -306,6 +306,16 @@ Changed Functionality - Libpcap based packet source now avoids the 32bit wraparound of link and dropped packet counters as reported by users. +- When per-connection SMB parser state (read offsets, tree ids, ...) exceeds + ``SMB::max_pending_messages`` (default 1000), Zeek discards such per-connection + state and raises a new ``smb2_discarded_messages_state()`` event. This event is + used to reset script-layer SMB state. This change provides protection against + unbounded state growth due to partial or one-sided SMB connections. + + Setting ``SMB::max_pending_messages`` to 0 can be used to switch back to the + previous behavior of not discarding state. Setting ``SMB::enable_state_clear`` + to ``F`` skips the script-layer state clearing logic. + Removed Functionality ---------------------