Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Lots of SMB1 parsing fixes.

Browse source
This commit is contained in:
Seth Hall 2016-08-08 15:36:07 -04:00
parent f03e4ce041
commit 117b5c3ac7
18 changed files with 193 additions and 159 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/frameworks/dpd/main.bro
View file

@ -27,6 +27,9 @@ export {
disabled_aids: set[count];
};
## Analyzers which you don't want to throw
const ignore_violations: set[Analyzer::Tag] = set() &redef;
## Ignore violations which go this many bytes into the connection.
## Set to 0 to never ignore protocol violations.
const ignore_violations_after = 10 * 1024 &redef;
@ -82,6 +85,9 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count, reason
if ( ignore_violations_after > 0 && size > ignore_violations_after )
return;
if ( atype in ignore_violations )
return;
# Disable the analyzer that raised the last core-generated event.
disable_analyzer(c$id, aid);
add c$dpd$disabled_aids[aid];

2
scripts/base/protocols/dce-rpc/main.bro
View file

@ -34,6 +34,8 @@ export {
} &redef;
}
redef DPD::ignore_violations += { Analyzer::ANALYZER_DCE_RPC };
type State: record {
uuid : string &optional;
named_pipe : string &optional;

2
scripts/base/protocols/ntlm/main.bro
View file

@ -46,6 +46,8 @@ export {
} &redef;
}
redef DPD::ignore_violations += { Analyzer::ANALYZER_NTLM };
redef record connection += {
ntlm: Info &optional;
};