Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Redo the response handling..

Browse source
This commit is contained in:
Vlad Grigorescu 2014-08-08 13:46:12 -05:00
parent 023661fb19
commit 1ceeafcb32
2 changed files with 54 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/protocols/mysql/main.bro
View file

@ -72,6 +72,12 @@ event mysql_command_request(c: connection, command: count, arg: string)
info$cmd = commands[command]; info$cmd = commands[command];
info$arg = sub(arg, /\0$/, ""); info$arg = sub(arg, /\0$/, "");
c$mysql = info; c$mysql = info;
if ( command == 1 )
{
# We get no response for quits, so let's just log it now.
Log::write(mysql::LOG, c$mysql);
delete c$mysql;
}
} }
} }

64
src/analyzer/protocol/mysql/mysql-protocol.pac
View file

@ -14,8 +14,12 @@ type uint24le = record {
}; };
type LengthEncodedInteger = record { type LengthEncodedInteger = record {
i1 : uint8; length : uint8;
val: case i1 of { integer : LengthEncodedIntegerLookahead(length);
};
type LengthEncodedIntegerLookahead(length: uint8) = record {
val: case length of {
0xfb -> i0 : empty; 0xfb -> i0 : empty;
0xfc -> i2 : uint16; 0xfc -> i2 : uint16;
0xfd -> i3 : uint24le; 0xfd -> i3 : uint24le;
@ -40,13 +44,26 @@ type LengthEncodedString = record {
} }
int operator()(LengthEncodedInteger* lei) const int operator()(LengthEncodedInteger* lei) const
{ {
if ( lei->i1() < 0xfb ) if ( lei->length() < 0xfb )
return lei->i1(); return lei->length();
else if ( lei->i1() == 0xfc ) else if ( lei->length() == 0xfc )
return lei->integer()->i2();
else if ( lei->length() == 0xfd )
return to_int()(lei->integer()->i3());
else if ( lei->length() == 0xfe )
return lei->integer()->i4();
else
return 0;
}
int operator()(LengthEncodedIntegerLookahead* lei) const
{
if ( lei->length() < 0xfb )
return lei->length();
else if ( lei->length() == 0xfc )
return lei->i2(); return lei->i2();
else if ( lei->i1() == 0xfd ) else if ( lei->length() == 0xfd )
return to_int()(lei->i3()); return to_int()(lei->i3());
else if ( lei->i1() == 0xfe ) else if ( lei->length() == 0xfe )
return lei->i4(); return lei->i4();
else else
return 0; return 0;
@ -105,6 +122,7 @@ enum Expected {
EXPECT_EOF1, EXPECT_EOF1,
EXPECT_EOF2, EXPECT_EOF2,
EXPECT_RESULTSET, EXPECT_RESULTSET,
EXPECT_QUERY_RESPONSE,
}; };
type NUL_String = RE/[^\0]*/; type NUL_String = RE/[^\0]*/;
@ -212,13 +230,13 @@ type Command_Request_Packet = record {
# Command Response # Command Response
type Command_Response = case $context.connection.get_expectation() of { type Command_Response = case $context.connection.get_expectation() of {
EXPECT_COLUMN_COUNT -> col_count : ColumnCount; EXPECT_COLUMN_COUNT -> col_count_meta : ColumnCountMeta;
EXPECT_COLUMN_DEFINITION -> col_defs : ColumnDefinitions; EXPECT_COLUMN_DEFINITION -> col_defs : ColumnDefinitions;
EXPECT_RESULTSET -> resultset : Resultset; EXPECT_RESULTSET -> resultset : Resultset;
EXPECT_STATUS -> status : Command_Response_Status; EXPECT_STATUS -> status : Command_Response_Status;
EXPECT_EOF1 -> eof1 : EOF1; EXPECT_EOF1 -> eof1 : EOF1;
EXPECT_EOF2 -> eof2 : EOF2; EXPECT_EOF2 -> eof2 : EOF2;
default -> unknown : empty; default -> unknown : empty;
}; };
type Command_Response_Status = record { type Command_Response_Status = record {
@ -231,8 +249,18 @@ type Command_Response_Status = record {
}; };
}; };
type ColumnCount = record { type ColumnCountMeta = record {
le_column_count : LengthEncodedInteger; byte : uint8;
pkt_type: case byte of {
0x00 -> ok : OK_Packet;
0xff -> err : ERR_Packet;
# 0xfb -> Not implemented
default -> col_count: ColumnCount(byte);
};
};
type ColumnCount(byte: uint8) = record {
le_column_count : LengthEncodedIntegerLookahead(byte);
} &let { } &let {
col_num : uint32 = to_int()(le_column_count); col_num : uint32 = to_int()(le_column_count);
update_col_num : bool = $context.connection.set_col_count(col_num); update_col_num : bool = $context.connection.set_col_count(col_num);
@ -304,11 +332,15 @@ type ERR_Packet = record {
code : uint16; code : uint16;
state: bytestring &length=6; state: bytestring &length=6;
msg : bytestring &restofdata; msg : bytestring &restofdata;
} &let {
update_state: bool = $context.connection.update_state(COMMAND_PHASE);
}; };
type EOF_Packet = record { type EOF_Packet = record {
warnings: uint16; warnings: uint16;
status : uint16; status : uint16;
} &let {
update_state: bool = $context.connection.update_state(COMMAND_PHASE);
}; };
# State tracking # State tracking