Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

scripts/smb2-main: Reset script-level state upon smb2_discarded_messages_state()

Browse source 
This is similar to what the external corelight/zeek-smb-clear-state script
does, but leverages the smb2_discarded_messages_state() event instead of
regularly checking on the state of SMB connections.

The pcap was created using the dperson/samba container image and mounting
a share with Linux's CIFS filesystem, then copying the content of a
directory with 100 files. The test uses a BPF filter to imitate mostly
"half-duplex" traffic.
This commit is contained in:
Arne Welzel 2023-04-25 17:19:14 +02:00
parent 5caab1a667
commit 3ac877e20d
8 changed files with 89 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
testing/btest/scripts/base/protocols/smb/smb2-max-pending-messages.test Normal file
View file

@ -0,0 +1,18 @@
# @TEST-DOC: Pcap contains 100 file transfers (read requests), force BPF filtering such that the responses aren't seen and we have state growth. Verify a low SMB::max_pending_messages triggers, logs a weird and that script-land message state is reset.
# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb2_100_small_files.pcap -f 'src port not 445 or tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0' %INPUT >out
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: btest-diff out
@load base/protocols/smb
redef SMB::max_pending_messages = 20;
event smb2_discarded_messages_state(c: connection, request: string) &priority=10
{
print "smb2_discarded_messages_state before", request, |c$smb_state$pending_cmds|;
}
event smb2_discarded_messages_state(c: connection, request: string) &priority=-10
{
print "smb2_discarded_messages_state after", request, |c$smb_state$pending_cmds|;
}