Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/ak/rdpeudp' of https://github.com/anthonykasza/zeek into topic/ak/rdpeudp

Browse source
This commit is contained in:
Anthony Kasza 2020-04-03 16:18:50 -06:00
commit 01decee777
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/rdp/rdpeudp-analyzer.pac
View file

@ -25,7 +25,7 @@ refine connection RDPEUDP_Conn += {
function is_rdpeudp2(): bool
%{
return ((orig_synex_flags_ & resp_synex_flags_) >= RDPUDP_PROTOCOL_VERSION_3);
return orig_synex_flags_ == RDPUDP_PROTOCOL_VERSION_3 && resp_synex_flags_ == RDPUDP_PROTOCOL_VERSION_3;
%}
function proc_rdpeudp_syn(is_orig: bool, uFlags: uint16, snSourceAck: uint32, uUdpVer: uint16): bool

2
src/analyzer/protocol/rdp/rdpeudp-protocol.pac
View file

@ -43,7 +43,7 @@ type RDPEUDP_SYN(pdu: RDPEUDP_PDU, is_orig: bool) = record {
type RDPUDP_SYNEX_PAYLOAD = record {
uSynExFlags: uint16;
uUdpVer: uint16;
cookieHash: case ((uUdpVer & RDPUDP_PROTOCOL_VERSION_3) > 0) of {
cookieHash: case (uUdpVer == RDPUDP_PROTOCOL_VERSION_3) of {
true -> has_cookie_hash: uint8[32];
false -> has_no_cookie_hash: empty;
};