Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'smb2-fix' of https://github.com/mauropalumbo75/zeek

Browse source 
* 'smb2-fix' of https://github.com/mauropalumbo75/zeek:
  added test and pcap files for smb_files.log fix
  fixing some missing log lines in smb_files.log
This commit is contained in:
Jon Siwek 2019-03-20 17:59:30 -07:00
commit 2d8acab664
7 changed files with 42 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.6-172 | 2019-03-20 17:59:30 -0700
* Fix smb_files.log missing FUID field in read/write actions (Mauro Palumbo)
2.6-169 | 2019-03-19 19:12:47 -0700
* Add support for NFLOG link-layer type (Ryan Denniston)

2
VERSION
View file

@ -1 +1 @@
2.6-169
2.6-172

1
scripts/base/protocols/smb/files.bro
View file

@ -64,5 +64,6 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
if ( c$smb_state$current_file?$name )
f$info$filename = c$smb_state$current_file$name;
write_file_log(c$smb_state);
}
}

11
testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log Normal file
View file

@ -0,0 +1,11 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path files
#open 2019-02-14-15-17-09
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count
1549644186.691869 FG403EpKSkh5CwCre 169.254.128.15 169.254.128.18 CHhAvVGS1DHFjwGM9 SMB 0 (empty) text/plain pythonfile 0.000000 - F 16 16 0 0 F - - - - - - -
1549644186.699376 FLCGB5TxPTWKKeQf4 169.254.128.18 169.254.128.15 CHhAvVGS1DHFjwGM9 SMB 0 (empty) text/plain pythonfile2 0.000000 - T 7000 - 0 0 F - - - - - - -
#close 2019-02-14-15-17-09

16
testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/smb_files.log Normal file
View file

@ -0,0 +1,16 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path smb_files
#open 2019-02-14-15-17-09
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size prev_name times.modified times.accessed times.created times.changed
#types time string addr port addr port string enum string string count string time time time time
1549644186.686127 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - pythonfile 16 - 1549643138.282481 1549643183.156000 1549643138.280000 1549643138.282481
1549644186.686127 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_READ - pythonfile 16 - 1549643138.282481 1549643183.156000 1549643138.280000 1549643138.282481
1549644186.686127 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 FG403EpKSkh5CwCre SMB::FILE_READ - pythonfile 16 - 1549643138.282481 1549643183.156000 1549643138.280000 1549643138.282481
1549644186.692584 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000
1549644186.692584 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_WRITE - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000
1549644186.692584 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 FLCGB5TxPTWKKeQf4 SMB::FILE_WRITE - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000
1549644187.702245 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - <share_root> 0 - 1549644186.688000 1549644187.700000 1549644186.688000 1549644186.688000
#close 2019-02-14-15-17-09

BIN
testing/btest/Traces/smb/smb2readwrite.pcap Normal file
View file

Binary file not shown.

9
testing/btest/scripts/base/protocols/smb/smb2-read-write.bro Normal file
View file

@ -0,0 +1,9 @@
# @TEST-EXEC: bro -C -r $TRACES/smb/smb2readwrite.pcap %INPUT
# @TEST-EXEC: btest-diff smb_files.log
# @TEST-EXEC: btest-diff files.log
# @TEST-EXEC: test ! -f dpd.log
@load base/protocols/smb
redef SMB::logged_file_actions += { SMB::FILE_READ, SMB::FILE_WRITE };