diff --git a/CHANGES b/CHANGES index 4147b145b2..a020d49faa 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,13 @@ +4.1.0-dev.323 | 2021-03-11 12:43:21 -0800 + + * ts fields in SMB logs now default to network_time() (Seth Hall, Corelight) + + This avoids a problem identified by amanbansal2709 in pull + request #1288. I fixed it in a different way than that pull request + by making sure the ts field is always set so that this isssue doesn't + return in the future. + 4.1.0-dev.320 | 2021-03-10 12:29:13 -0800 * GH-1432: Use buffered IO for file extraction (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index da88f6120c..4049270217 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -4.1.0-dev.320 +4.1.0-dev.323 diff --git a/scripts/base/protocols/smb/main.zeek b/scripts/base/protocols/smb/main.zeek index 974dae8920..cfccde16ac 100644 --- a/scripts/base/protocols/smb/main.zeek +++ b/scripts/base/protocols/smb/main.zeek @@ -48,7 +48,7 @@ export { ## This record is for the smb_files.log type FileInfo: record { ## Time when the file was first discovered. - ts : time &log; + ts : time &log &default=network_time(); ## Unique ID of the connection the file was sent over. uid : string &log; ## ID of the connection the file was sent over. @@ -74,7 +74,7 @@ export { ## This record is for the smb_mapping.log type TreeInfo: record { ## Time when the tree was mapped. - ts : time &log &optional; + ts : time &log &default=network_time(); ## Unique ID of the connection the tree was mapped over. uid : string &log; ## ID of the connection the tree was mapped over. @@ -94,7 +94,7 @@ export { ## This record is for the smb_cmd.log type CmdInfo: record { ## Timestamp of the command request. - ts : time &log; + ts : time &log &default=network_time(); ## Unique ID of the connection the request was sent over. uid : string &log; ## ID of the connection the request was sent over. diff --git a/scripts/base/protocols/smb/smb1-main.zeek b/scripts/base/protocols/smb/smb1-main.zeek index 1369dc1714..9dabdd1c36 100644 --- a/scripts/base/protocols/smb/smb1-main.zeek +++ b/scripts/base/protocols/smb/smb1-main.zeek @@ -47,9 +47,9 @@ event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=5 if ( mid !in smb_state$pending_cmds ) { - local tmp_cmd = SMB::CmdInfo($ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB1", $command = SMB1::commands[hdr$command]); + local tmp_cmd = SMB::CmdInfo($uid=c$uid, $id=c$id, $version="SMB1", $command = SMB1::commands[hdr$command]); - local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id); + local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id); tmp_cmd$referenced_file = tmp_file; tmp_cmd$referenced_tree = smb_state$current_tree; @@ -104,7 +104,7 @@ event smb1_negotiate_response(c: connection, hdr: SMB1::Header, response: SMB1:: event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) &priority=5 { - local tmp_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id, $path=path, $service=service); + local tmp_tree = SMB::TreeInfo($uid=c$uid, $id=c$id, $path=path, $service=service); c$smb_state$current_cmd$referenced_tree = tmp_tree; c$smb_state$current_cmd$argument = path; @@ -132,7 +132,7 @@ event smb1_tree_connect_andx_response(c: connection, hdr: SMB1::Header, service: event smb1_nt_create_andx_request(c: connection, hdr: SMB1::Header, name: string) &priority=5 { - local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id); + local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id); c$smb_state$current_cmd$referenced_file = tmp_file; c$smb_state$current_cmd$referenced_file$name = name; diff --git a/scripts/base/protocols/smb/smb2-main.zeek b/scripts/base/protocols/smb/smb2-main.zeek index 0458b08c66..59436a2c8c 100644 --- a/scripts/base/protocols/smb/smb2-main.zeek +++ b/scripts/base/protocols/smb/smb2-main.zeek @@ -26,8 +26,8 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5 if ( mid !in smb_state$pending_cmds ) { - local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id); - local tmp_cmd = SMB::CmdInfo($ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB2", $command = SMB2::commands[hdr$command]); + local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id); + local tmp_cmd = SMB::CmdInfo($uid=c$uid, $id=c$id, $version="SMB2", $command = SMB2::commands[hdr$command]); tmp_cmd$referenced_file = tmp_file; smb_state$pending_cmds[mid] = tmp_cmd; } @@ -41,14 +41,14 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5 } else if ( tid !in smb_state$tid_map ) { - local tmp_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id); + local tmp_tree = SMB::TreeInfo($uid=c$uid, $id=c$id); smb_state$tid_map[tid] = tmp_tree; } smb_state$current_cmd$referenced_tree = smb_state$tid_map[tid]; } else { - smb_state$current_cmd$referenced_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id); + smb_state$current_cmd$referenced_tree = SMB::TreeInfo($uid=c$uid, $id=c$id); } smb_state$current_file = smb_state$current_cmd$referenced_file; diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private index d87e96c6b4..f15b634368 100644 --- a/testing/external/commit-hash.zeek-testing-private +++ b/testing/external/commit-hash.zeek-testing-private @@ -1 +1 @@ -10fcc15327154796ec9cfd4e1448f92d00fde2c5 +d15d95ad14e8974d828f9ee64fcd6cb313f004a2