From 4807b7d8479ecaf7a4366af7f6dc112070a908c3 Mon Sep 17 00:00:00 2001
From: Jeffrey Bencteux <jeffrey.bencteux@ssi.gouv.fr>
Date: Thu, 18 Jan 2018 15:20:47 +0100
Subject: [PATCH] add test for smb1_com_transaction2_request event changes

---
 .../.stdout                                      |   1 +
 .../Traces/smb/smb1_transaction2_request.pcap    | Bin 0 -> 1568 bytes
 .../protocols/smb/smb1-transaction2-request.test |  12 ++++++++++++
 3 files changed, 13 insertions(+)
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout
 create mode 100644 testing/btest/Traces/smb/smb1_transaction2_request.pcap
 create mode 100644 testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test

diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout
new file mode 100644
index 0000000000..a31a286d1f
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout
@@ -0,0 +1 @@
+smb1_transaction2_request hdr: [command=50, status=0, flags=0, flags2=0, tid=47242, pid=1, uid=2017, mid=2], args: [total_param_count=13, total_data_count=0, max_param_count=0, max_data_count=0, max_setup_count=0, flags=0, trans_timeout=0, param_count=13, param_offset=69, data_count=0, data_offset=0, setup_count=1], sub_cmd: 5
diff --git a/testing/btest/Traces/smb/smb1_transaction2_request.pcap b/testing/btest/Traces/smb/smb1_transaction2_request.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..564579597ee6b17ce0967c2b74641841c3a011d5
GIT binary patch
literal 1568
zcmbVMUr19?9RAMT%r$2->CbwQE?BUjmX4ty7*?!WrEF~>=pLpd=tBigQ;2Gip+yh%
z*h>}$>0pF{ln;hcphZu)2qLBEJs%25A=mGB&hBu#`CtcrhjY(8=eysZb8h<e#A6Ls
z7%h_l1U<|=iM4z`Vn+>)x!$e4Tv|*mrntAk54d?*!<Ln+Gouhxn%^y^4V0j!V|GlT
z{34V(dcmdkD=dj}kT3{ks-F=UNlg3QBjY#cX|afvCzF=jfM(5nVm`YQ|G`HPS~^&!
z<IxVq$MV6BE`sMWscOxtI#r-bp}2I+yr*rz;Y_&kST~Pc+^uiyo(4FeHAVEZje3=*
z+AHlWrw<!;nv8IVirI+H-U1`igysvDC6haA75#;@9m6!qWkR_hvPqPZf1<dO$-N7-
z4d}?xAF?#anOvvnZwD-1^1^zQUkE(20Dpca;2gcx-+pgiyvf*f?7E_Pzs~JRMd&<)
z5ut^r<tU5*pAaef%Y-8*+T`{|XUI1)K2Xn@4fiXQr4<LB6C#%hWlUxEd$k}lg+iIF
z4$(H?8jFte$i*VpHzm3>gBUtXyxBL#r6{83N(9^D@ssEMVUpS0b?L(8zPRr5ROOAW
zbayCvfpQ=kZ4NYf&qM>k<NH9JG~>aV0|{EgWy-EQv{hzzAV0f-dRjagbfxB&Khp>}
zk&`h*q2x7zZ^arcOhcd|$F0Uwjd0t=_BLW%>+vDND)>Sj`nYZL;Y?CEgB;GolnN)H
zJJCm<<T8cRrNUXMD+ouSP&jYp2}3=r>djMQJSbJtT-LRbxfPX8bkZI!lesM+yEM0<
zz}!Jvyv*hf@*fBA<Y*-F&Asy?&)g!JDPEC@uBT%2CN7hSQ_@8GEi#JjhrnGTz-2P=
zde+4K1tuyKGO_grlgBw`ZyaAalkE)l&eHX>a$G8}DjQqG)>12$w<Frq5$}oOF9^c2
A8vp<R

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test b/testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test
new file mode 100644
index 0000000000..9cd7c996f7
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test
@@ -0,0 +1,12 @@
+#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction2_request.pcap %INPUT
+#@TEST-EXEC: btest-diff .stdout
+
+@load base/protocols/smb
+@load policy/protocols/smb
+
+# Check that smb1_transaction2 requests are parsed correctly
+
+event smb1_transaction2_request(c: connection, hdr: SMB1::Header, args: SMB1::Trans2_Args, sub_cmd: count)
+{
+	print fmt("smb1_transaction2_request hdr: %s, args: %s, sub_cmd: %x", hdr, args, sub_cmd);
+}