Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixing types.

Browse source 
Added handling for fields sub fields.

Added test script and output.
This commit is contained in:
jatkinosn 2019-06-20 10:47:05 -04:00
parent 7b42c3a201
commit 3a19af86c5
5 changed files with 52 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/init-bare.zeek
View file

@ -4307,8 +4307,12 @@ export {
}; };
type RDP::ClientClusterData: record { type RDP::ClientClusterData: record {
flags: count; flags: count;
redir_session_id: count; redir_session_id: count;
redir_supported: bool;
svr_session_redir_version_mask: count;
redir_sessionid_field_valid: count;
redir_smartcard: bool;
}; };
## The list of channels requested by the client. ## The list of channels requested by the client.

4
src/analyzer/protocol/rdp/rdp-analyzer.pac
View file

@ -164,6 +164,10 @@ refine flow RDP_Flow += {
RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData); RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData);
ccld->Assign(0, val_mgr->GetCount(${ccluster.flags})); ccld->Assign(0, val_mgr->GetCount(${ccluster.flags}));
ccld->Assign(1, val_mgr->GetCount(${ccluster.redir_session_id})); ccld->Assign(1, val_mgr->GetCount(${ccluster.redir_session_id}));
ccld->Assign(2, val_mgr->GetBool(${ccluster.REDIRECTION_SUPPORTED}));
ccld->Assign(3, val_mgr->GetCount(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK}));
ccld->Assign(4, val_mgr->GetCount(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID}));
ccld->Assign(5, val_mgr->GetBool(${ccluster.REDIRECTED_SMARTCARD}));
BifEvent::generate_rdp_client_cluster_data(connection()->bro_analyzer(), BifEvent::generate_rdp_client_cluster_data(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(), connection()->bro_analyzer()->Conn(),

4
src/analyzer/protocol/rdp/rdp-protocol.pac
View file

@ -235,8 +235,8 @@ type Client_Cluster_Data = record {
redir_session_id: uint32; redir_session_id: uint32;
} &let { } &let {
REDIRECTION_SUPPORTED: bool = redir_session_id & 0x00000001; REDIRECTION_SUPPORTED: bool = redir_session_id & 0x00000001;
SERVER_SESSION_REDIRECTION_VERSION_MASK: int = (redir_session_id & 0x0000003C); SERVER_SESSION_REDIRECTION_VERSION_MASK: uint8 = (redir_session_id & 0x0000003C);
REDIRECTED_SESSIONID_FIELD_VALID: int = (redir_session_id & 0x00000002); REDIRECTED_SESSIONID_FIELD_VALID: uint8 = (redir_session_id & 0x00000002);
REDIRECTED_SMARTCARD: bool = redir_session_id & 0x00000040; REDIRECTED_SMARTCARD: bool = redir_session_id & 0x00000040;
} &byteorder=littleendian; } &byteorder=littleendian;

12
testing/btest/Baseline/scripts.base.protocols.rdp.rdp-client-cluster_data/out Normal file
View file

@ -0,0 +1,12 @@
RDP Client Cluster Data
Flags: 0000000d
RedirSessionId: 00000000
Redirection Supported: 00000000
ServerSessionRedirectionVersionMask: 00000000
RedirectionSessionIDFieldValid: 00000000
RedirectedSmartCard: 00000000
RDP Client Channel List Options
80800000
c0000000
c0800000
c0a00000

28
testing/btest/scripts/base/protocols/rdp/rdp-client-cluster-data.zeek Normal file
View file

@ -0,0 +1,28 @@
# @TEST-EXEC: zeek -r $TRACES/rdp/rdp-proprietary-encryption.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
@load base/protocol/rdp
event rdp_client_cluster_data(c: connection, data: RDP::ClientClusterData)
{
print "RDP Client Cluster Data";
#print data;
print fmt("Flags: %08x",data$flags);
print fmt("RedirSessionId: %08x",data$redir_session_id);
print fmt("Redirection Supported: %08x",data$redir_supported);
print fmt("ServerSessionRedirectionVersionMask: %08x",data$svr_session_redir_version_mask);
print fmt("RedirectionSessionIDFieldValid: %08x",data$redir_sessionid_field_valid);
print fmt("RedirectedSmartCard: %08x",data$redir_smartcard);
}
event rdp_client_network_data(c: connection, channels: RDP::ClientChannelList)
{
print "RDP Client Channel List Options";
for ( i in channels ) {
print fmt("%08x", channels[i]$options);
}
}