diff --git a/scripts/base/protocols/dce-rpc/main.bro b/scripts/base/protocols/dce-rpc/main.bro index c0e36624d2..b6de70cb78 100644 --- a/scripts/base/protocols/dce-rpc/main.bro +++ b/scripts/base/protocols/dce-rpc/main.bro @@ -160,12 +160,12 @@ event dce_rpc_response(c: connection, fid: count, opnum: count, stub_len: count) { # If there is not an endpoint, there isn't much reason to log. # This can happen if the request isn't seen. - if ( (c$dce_rpc?$endpoint && c$dce_rpc?$operation && - c$dce_rpc$endpoint !in ignored_operations) - || - (c$dce_rpc?$endpoint && c$dce_rpc?$operation && - c$dce_rpc$operation !in ignored_operations[c$dce_rpc$endpoint] && - "*" !in ignored_operations[c$dce_rpc$endpoint]) ) + if ( (c$dce_rpc?$endpoint && c$dce_rpc?$operation) && + ( c$dce_rpc$endpoint !in ignored_operations + || + ( c$dce_rpc?$endpoint && c$dce_rpc?$operation && + c$dce_rpc$operation !in ignored_operations[c$dce_rpc$endpoint] && + "*" !in ignored_operations[c$dce_rpc$endpoint]) ) ) { Log::write(LOG, c$dce_rpc); } @@ -196,12 +196,12 @@ event connection_state_remove(c: connection) } } - if ( (c$dce_rpc?$endpoint && c$dce_rpc?$operation && - c$dce_rpc$endpoint !in ignored_operations) - || - (c$dce_rpc?$endpoint && c$dce_rpc?$operation && - c$dce_rpc$operation !in ignored_operations[c$dce_rpc$endpoint] && - "*" !in ignored_operations[c$dce_rpc$endpoint]) ) + if ( (c$dce_rpc?$endpoint && c$dce_rpc?$operation) && + ( c$dce_rpc$endpoint !in ignored_operations + || + ( c$dce_rpc?$endpoint && c$dce_rpc?$operation && + c$dce_rpc$operation !in ignored_operations[c$dce_rpc$endpoint] && + "*" !in ignored_operations[c$dce_rpc$endpoint]) ) ) { Log::write(LOG, c$dce_rpc); }