diff --git a/CHANGES b/CHANGES index 075bcbb0b4..c56a0b32f0 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.6-172 | 2019-03-20 17:59:30 -0700 + + * Fix smb_files.log missing FUID field in read/write actions (Mauro Palumbo) + 2.6-169 | 2019-03-19 19:12:47 -0700 * Add support for NFLOG link-layer type (Ryan Denniston) diff --git a/VERSION b/VERSION index f202669123..2009f96325 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-169 +2.6-172 diff --git a/scripts/base/protocols/smb/files.bro b/scripts/base/protocols/smb/files.bro index 0ee4d0a873..5916624941 100644 --- a/scripts/base/protocols/smb/files.bro +++ b/scripts/base/protocols/smb/files.bro @@ -64,5 +64,6 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori if ( c$smb_state$current_file?$name ) f$info$filename = c$smb_state$current_file$name; + write_file_log(c$smb_state); } } diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log new file mode 100644 index 0000000000..7704087a53 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path files +#open 2019-02-14-15-17-09 +#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size +#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count +1549644186.691869 FG403EpKSkh5CwCre 169.254.128.15 169.254.128.18 CHhAvVGS1DHFjwGM9 SMB 0 (empty) text/plain pythonfile 0.000000 - F 16 16 0 0 F - - - - - - - +1549644186.699376 FLCGB5TxPTWKKeQf4 169.254.128.18 169.254.128.15 CHhAvVGS1DHFjwGM9 SMB 0 (empty) text/plain pythonfile2 0.000000 - T 7000 - 0 0 F - - - - - - - +#close 2019-02-14-15-17-09 diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/smb_files.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/smb_files.log new file mode 100644 index 0000000000..197ad14bca --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/smb_files.log @@ -0,0 +1,16 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path smb_files +#open 2019-02-14-15-17-09 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size prev_name times.modified times.accessed times.created times.changed +#types time string addr port addr port string enum string string count string time time time time +1549644186.686127 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - pythonfile 16 - 1549643138.282481 1549643183.156000 1549643138.280000 1549643138.282481 +1549644186.686127 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_READ - pythonfile 16 - 1549643138.282481 1549643183.156000 1549643138.280000 1549643138.282481 +1549644186.686127 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 FG403EpKSkh5CwCre SMB::FILE_READ - pythonfile 16 - 1549643138.282481 1549643183.156000 1549643138.280000 1549643138.282481 +1549644186.692584 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000 +1549644186.692584 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_WRITE - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000 +1549644186.692584 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 FLCGB5TxPTWKKeQf4 SMB::FILE_WRITE - pythonfile2 0 - 1549644186.688000 1549644186.688000 1549644186.688000 1549644186.688000 +1549644187.702245 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 - SMB::FILE_OPEN - 0 - 1549644186.688000 1549644187.700000 1549644186.688000 1549644186.688000 +#close 2019-02-14-15-17-09 diff --git a/testing/btest/Traces/smb/smb2readwrite.pcap b/testing/btest/Traces/smb/smb2readwrite.pcap new file mode 100644 index 0000000000..723dd58c25 Binary files /dev/null and b/testing/btest/Traces/smb/smb2readwrite.pcap differ diff --git a/testing/btest/scripts/base/protocols/smb/smb2-read-write.bro b/testing/btest/scripts/base/protocols/smb/smb2-read-write.bro new file mode 100644 index 0000000000..0d59e7a495 --- /dev/null +++ b/testing/btest/scripts/base/protocols/smb/smb2-read-write.bro @@ -0,0 +1,9 @@ +# @TEST-EXEC: bro -C -r $TRACES/smb/smb2readwrite.pcap %INPUT +# @TEST-EXEC: btest-diff smb_files.log +# @TEST-EXEC: btest-diff files.log +# @TEST-EXEC: test ! -f dpd.log + +@load base/protocols/smb + +redef SMB::logged_file_actions += { SMB::FILE_READ, SMB::FILE_WRITE }; +