Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

smb2: Raise smb2_file_delete for CREATE with FILE_DELETE_ON_CLOSE

Browse source 
When a CREATE request contains the FILE_DELETE_ON_CLOSE option and
the subsequent CREATE response indicates success, we now raise the
smb2_file_delete event to log a delete action in smb_files.log and
also give users a way to handle this scenario.

The provided pcap was generated locally by recording a smbtorture run
of the smb2.delete-on-close-perms test case.

Placed the create_options into the CmdInfo record for potential
exposure in smb_cmd.log (wasn't sure how that would look so left it
for the future).

Fixes #2276.
This commit is contained in:
Arne Welzel 2022-07-15 15:13:40 +02:00
parent 1d2c12e980
commit 3dae8ab086
5 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/scripts/base/protocols/smb/smb2-create-delete-on-close.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: zeek -C -r $TRACES/smb/smb2.delete-on-close-perms-delete-existing.pcap policy/protocols/smb/log-cmds
# @TEST-EXEC: btest-diff smb_files.log
# @TEST-EXEC: btest-diff smb_cmd.log
@load base/protocols/smb
redef SMB::logged_file_actions += { SMB::FILE_READ, SMB::FILE_WRITE };