Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/awelzel/smb2-state-handling'

Browse source 
* origin/topic/awelzel/smb2-state-handling:
  NEWS: Add entry about SMB::max_pending_messages and state discarding
  scripts/smb2-main: Reset script-level state upon smb2_discarded_messages_state()
  smb2: Limit per-connection read/ioctl/tree state
This commit is contained in:
Arne Welzel 2023-05-04 09:30:18 +02:00
commit 12252743b1
17 changed files with 183 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

18
testing/btest/scripts/base/protocols/smb/smb2-max-pending-messages.test Normal file
View file

@ -0,0 +1,18 @@
# @TEST-DOC: Pcap contains 100 file transfers (read requests), force BPF filtering such that the responses aren't seen and we have state growth. Verify a low SMB::max_pending_messages triggers, logs a weird and that script-land message state is reset.
# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb2_100_small_files.pcap -f 'src port not 445 or tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0' %INPUT >out
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: btest-diff out
@load base/protocols/smb
redef SMB::max_pending_messages = 20;
event smb2_discarded_messages_state(c: connection, request: string) &priority=10
{
print "smb2_discarded_messages_state before", request, |c$smb_state$pending_cmds|;
}
event smb2_discarded_messages_state(c: connection, request: string) &priority=-10
{
print "smb2_discarded_messages_state after", request, |c$smb_state$pending_cmds|;
}