Merge remote-tracking branch 'origin/topic/awelzel/4730-smb-read-response-data-offset'

* origin/topic/awelzel/4730-smb-read-response-data-offset:
  smb2/read: Parse only 1 byte for data_offset, ignore reserved1

(cherry picked from commit 76289a8022)

CHANGES

@@ -1,3 +1,14 @@
+8.0.0-rc1.4 | 2025-08-11 11:38:57 -0700
+
+  * smb2/read: Parse only 1 byte for data_offset, ignore reserved1 (Arne Welzel, Corelight)
+
+    A user provided a SMB2 pcap with the reserved1 field of a ReadResponse
+    set to 1 instead of 0. This confused the padding computation due to
+    including this byte into the offset. Properly split data_offset and
+    reserved1 into individual byte fields.
+
+    (cherry picked from commit 76289a8022d258f94c4cba003dfa657428a247b1)
+
 8.0.0-rc1.3 | 2025-08-11 11:35:42 -0700
 
   * GH-4176: cluster: Add on_subscribe() and on_unsubscribe() hooks (Arne Welzel, Corelight)

VERSION

@@ -1 +1 @@
-8.0.0-rc1.3
+8.0.0-rc1.4

src/analyzer/protocol/smb/smb2-com-read.pac

@@ -93,10 +93,11 @@ type SMB2_read_request(header: SMB2_Header) = record {
 
 type SMB2_read_response(header: SMB2_Header) = record {
 	structure_size    : uint16;
-	data_offset       : uint16;
+	data_offset       : uint8;
+	reserved1         : uint8;
 	data_len          : uint32;
 	data_remaining    : uint32;
-	reserved          : uint32;
+	reserved2         : uint32;
 	pad               : padding to data_offset - header.head_length;
 	data              : bytestring &length=data_len;
 } &let {

testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-response-non-zero-reserved1/files.log

@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	files
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	fuid	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	source	depth	analyzers	mime_type	filename	duration	local_orig	is_orig	seen_bytes	total_bytes	missing_bytes	overflow_bytes	timedout	parent_fuid
+#types	time	string	string	addr	port	addr	port	string	count	set[string]	string	string	interval	bool	bool	count	count	count	count	bool	string
+XXXXXXXXXX.XXXXXX	FmcSEk2dq4v0hewpM4	CHhAvVGS1DHFjwGM9	172.31.112.17	57829	172.31.112.16	445	SMB	0	(empty)	text/plain	Test.txt	0.000000	T	F	189	189	0	0	F	-
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/Traces/README

@@ -53,3 +53,6 @@ Trace Index/Sources:
 - ldap/adduser1.pcap ldap/adduser1-ntlm.pcap
   Provided by Mohan-Dhawan on #4275
   https://github.com/zeek/zeek/issues/4275
+- smb_v2_only_non_zero_reserved1.pcap
+  Provided by @predator89090 on #4730
+  https://github.com/zeek/zeek/issues/4730

testing/btest/scripts/base/protocols/smb/smb2-read-response-non-zero-reserved1.test

@@ -0,0 +1,9 @@
+# @TEST-DOC: Regression test for #4730, ReadResponse not parsed properly.
+#
+# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb_v2_only_non_zero_reserved1.pcap %INPUT
+# @TEST-EXEC: btest-diff files.log
+# @TEST-EXEC: test ! -f analyzer.log
+# @TEST-EXEC: test ! -f weird.log
+
+@load base/protocols/smb
+