guess 0.1.5

High-performance zero-copy network protocol detection from first bytes.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

/* src/protocols/smb.rs */

/// Detects SMB protocol (Server Message Block).
///
/// Supports `SMBv1` (\xffSMB) and SMBv2/v3 (\xfeSMB).
#[inline(always)]
pub(crate) fn detect(data: &[u8]) -> bool {
	if data.len() < 4 {
		return false;
	}

	let magic = &data[0..4];
	if magic == b"\xffSMB" || magic == b"\xfeSMB" {
		return true;
	}

	if data.len() >= 8 && data[0] == 0x00 {
		let len = u32::from_be_bytes([0, data[1], data[2], data[3]]);
		let inner_magic = &data[4..8];

		if inner_magic == b"\xffSMB" {
			return len >= 32;
		} else if inner_magic == b"\xfeSMB" {
			return len >= 64;
		}
	}

	false
}

#[cfg(test)]
mod tests {
	use super::*;

	#[test]
	fn test_detect_raw_smbv1() {
		let mut data = [0u8; 64];
		data[0..4].copy_from_slice(b"\xffSMB");
		assert!(detect(&data));
	}

	#[test]
	fn test_detect_raw_smbv2() {
		let mut data = [0u8; 64];
		data[0..4].copy_from_slice(b"\xfeSMB");
		assert!(detect(&data));
	}

	#[test]
	fn test_detect_encapsulated_smbv2() {
		let mut data = [0u8; 64];
		data[0] = 0x00;
		data[3] = 64;
		data[4..8].copy_from_slice(b"\xfeSMB");
		assert!(detect(&data));
	}

	#[test]
	fn test_detect_encapsulated_smbv1() {
		let mut data = [0u8; 64];
		data[0] = 0x00;
		data[3] = 32;
		data[4..8].copy_from_slice(b"\xffSMB");
		assert!(detect(&data));
	}

	#[test]
	fn test_reject_encapsulated_smbv2_too_short() {
		let mut data = [0u8; 64];
		data[0] = 0x00;
		data[3] = 48;
		data[4..8].copy_from_slice(b"\xfeSMB");
		assert!(!detect(&data));
	}

	#[test]
	fn test_reject_encapsulated_smbv1_too_short() {
		let mut data = [0u8; 64];
		data[0] = 0x00;
		data[3] = 20;
		data[4..8].copy_from_slice(b"\xffSMB");
		assert!(!detect(&data));
	}

	#[test]
	fn test_reject_invalid_magic() {
		assert!(!detect(b"\xfdSMB"));
	}

	#[test]
	fn test_reject_random_data() {
		assert!(!detect(&[0x42; 64]));
	}
}