Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Improve the SMB2 documentation.

Browse source 
* Clean it up, make it more consistent, and add references to similar events.
* Commented out the smb2_set_info_request event, which wasn't being generated.
* Documented the SMB2 record types in init-bare
This commit is contained in:
Vlad Grigorescu 2016-10-03 16:24:47 -05:00
parent 260c985094
commit 03f9a8675f
11 changed files with 227 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocol/smb/smb2_com_close.bif
View file

@ -1,19 +1,25 @@
## Generated for SMB2 request messages of type *close*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *close*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## file_name: The SMB2 GUID of the file being closed.
##
## .. bro:see:: smb2_message smb2_close_response
event smb2_close_request%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID%);
## Generated for SMB2 response messages of type *close*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 responses of type *close*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## response: A record of attributes returned from the server from the close.
##
## .. bro:see:: smb2_message smb2_close_request
event smb2_close_response%(c: connection, hdr: SMB2::Header, response: SMB2::CloseResponse%);

14
src/analyzer/protocol/smb/smb2_com_create.bif
View file

@ -1,17 +1,21 @@
## Generated for SMB2 request messages of type *create*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *create*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## file_name: The name of the file being requested.
##
## .. bro:see:: smb2_message smb2_create_response
event smb2_create_request%(c: connection, hdr: SMB2::Header, file_name: string%);
## Generated for SMB2 response messages of type *create*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 responses of type *create*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## file_id: The SMB2 GUID for the file.
##
@ -20,4 +24,6 @@ event smb2_create_request%(c: connection, hdr: SMB2::Header, file_name: string%)
## times: Timestamps associated with the file in question.
##
## attrs: File attributes.
##
## .. bro:see:: smb2_message smb2_create_request
event smb2_create_response%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, size: count, times: SMB::MACTimes, attrs: SMB2::FileAttrs%);

2
src/analyzer/protocol/smb/smb2_com_ioctl.bif
View file

@ -1 +1 @@
# Emoty.
# Empty.

14
src/analyzer/protocol/smb/smb2_com_negotiate.bif
View file

@ -1,19 +1,25 @@
## Generated for SMB2 messages of type *negotiate*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *negotiate*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## dialects: A vector of the client's supported dialects.
##
## .. bro:see:: smb2_message smb2_negotiate_response
event smb2_negotiate_request%(c: connection, hdr: SMB2::Header, dialects: index_vec%);
## Generated for SMB2 messages of type *negotiate response*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 responses of type *negotiate*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## response: The negotiate response data structure.
##
## .. bro:see:: smb2_message smb2_negotiate_request
event smb2_negotiate_response%(c: connection, hdr: SMB2::Header, response: SMB2::NegotiateResponse%);
#### Types

7
src/analyzer/protocol/smb/smb2_com_read.bif
View file

@ -1,12 +1,15 @@
## Generated for SMB2 request messages of type *read*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *read*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## file_id: The GUID being used for the file.
##
## offset: How far into the file this read should be taking place.
##
## length: The number of bytes of the file being read.
##
## .. bro:see:: smb2_message
event smb2_read_request%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, length: count%);

14
src/analyzer/protocol/smb/smb2_com_session_setup.bif
View file

@ -1,19 +1,25 @@
## Generated for SMB2 request messages of type *session_setup*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *session_setup*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## request: A record containing more information related to the request.
##
## .. bro:see:: smb2_message smb2_session_setup_response
event smb2_session_setup_request%(c: connection, hdr: SMB2::Header, request: SMB2::SessionSetupRequest%);
## Generated for SMB2 response messages of type *session_setup*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 responses of type *session_setup*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## response: A record containing more information related to the response.
##
## .. bro:see:: smb2_message smb2_session_setup_request
event smb2_session_setup_response%(c: connection, hdr: SMB2::Header, response: SMB2::SessionSetupResponse%);
#### Types

43
src/analyzer/protocol/smb/smb2_com_set_info.bif
View file

@ -1,31 +1,42 @@
## Generated for SMB2 request messages of type *set_info*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *set_info* of the *rename* subtype.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
##
## request: A record containing more information related to the request.
event smb2_set_info_request%(c: connection, hdr: SMB2::Header, request: SMB2::SetInfoRequest%);
type SMB2::SetInfoRequest: record;
## Generated for SMB2 SetInfo File request messages of the rename subtype.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## file_id: A GUID to identify the file.
##
## dst_filename: The filename to rename the file into.
##
## .. bro:see:: smb2_message smb2_set_info_request smb2_file_delete
event smb2_file_rename%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, dst_filename: string%);
## Generated for SMB2 SetInfo File request messages of the disposition (delete) subtype.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *set_info* of the *delete* subtype.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## delete_pending: A boolean value to indicate that a file should be deleted
## when it's closed if set to T.
event smb2_file_delete%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, delete_pending: bool%);
##
## .. bro:see:: smb2_message smb2_set_info_request smb2_file_rename
event smb2_file_delete%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, delete_pending: bool%);
# TODO - Not implemented
# Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
# version 2 requests of type *set_info*.
#
# c: The connection.
#
# hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
#
# request: A record containing more information related to the request.
#
# .. bro:see:: smb2_message smb2_file_rename smb2_file_delete
# event smb2_set_info_request%(c: connection, hdr: SMB2::Header, request: SMB2::SetInfoRequest%);
#
# type SMB2::SetInfoRequest: record;

14
src/analyzer/protocol/smb/smb2_com_tree_connect.bif
View file

@ -1,19 +1,25 @@
## Generated for SMB2 request messages of type *tree_connect*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *tree_connect*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## path: Path of the requested tree.
##
## .. bro:see:: smb2_message smb2_tree_connect_response
event smb2_tree_connect_request%(c: connection, hdr: SMB2::Header, path: string%);
## Generated for SMB2 response messages of type *tree_connect*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 responses of type *tree_connect*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## response: A record with more information related to the response.
##
## .. bro:see:: smb2_message smb2_tree_connect_request
event smb2_tree_connect_response%(c: connection, hdr: SMB2::Header, response: SMB2::TreeConnectResponse%);
type SMB2::TreeConnectResponse: record;

7
src/analyzer/protocol/smb/smb2_com_write.bif
View file

@ -1,12 +1,15 @@
## Generated for SMB2 request messages of type *write*.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 requests of type *write*.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## file_id: The GUID being used for the file.
##
## offset: How far into the file this write should be taking place.
##
## length: The number of bytes of the file being written.
##
## .. bro:see:: smb2_message
event smb2_write_request%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, length: count%);

17
src/analyzer/protocol/smb/smb2_events.bif
View file

@ -1,12 +1,17 @@
## Generated for all SMB2 messages.
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 messages.
##
## See `Wikipedia <http://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the
## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Bro's
## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses
## both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on
## ports 138/139 and :abbr:`SMB (Server Message Block)`-over-TCP on port 445.
##
## c: The connection.
##
## hdr: The parsed header of the SMB2 message.
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
##
## is_orig: True if the message came from the originator side.
##
## .. bro:see:: smb1_message
event smb2_message%(c: connection, hdr: SMB2::Header, is_orig: bool%);