Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'smb-transaction-messages' of https://github.com/jbencteux/bro

Browse source 
* 'smb-transaction-messages' of https://github.com/jbencteux/bro:
  add test for smb1_com_transaction_response event changes
  add test for smb1_com_transaction2_secondary_request event changes
  add test for smb1_com_transaction2_request event changes
  add test for smb1_com_transaction_secondary_request event changes
  add test for smb1_com_transaction_request event changes
  fix setup field handling in smb1_com_transaction_request messages
  fix smb1_com_transaction* messages
  add smb1_transaction2_secondary_request event
  add smb1_transaction_secondary_request event
  add parameters and data to smb1_transaction_request/response messages
  add SMB_Parameters.Words to smb1_transaction2_request event
This commit is contained in:
Jon Siwek 2018-02-05 16:28:25 -06:00
commit 4cd9f0edf9
34 changed files with 486 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test Normal file
View file

@ -0,0 +1,12 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_request.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/smb
@load policy/protocols/smb
# Check that smb1_transaction requests are parsed correctly
event smb1_transaction_request(c: connection, hdr: SMB1::Header, name: string, sub_cmd: count, parameters: string, data: string)
{
print fmt("smb1_transaction_request hdr: %s, name: %s, sub_cmd: %x, params: %s, data: %s", hdr, name, sub_cmd, parameters, data);
}

12
testing/btest/scripts/base/protocols/smb/smb1-transaction-response.test Normal file
View file

@ -0,0 +1,12 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_response.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/smb
@load policy/protocols/smb
# Check that smb1_transaction_response requests are parsed correctly
event smb1_transaction_response(c: connection, hdr: SMB1::Header, parameters: string, data: string)
{
print fmt("smb1_transaction_response hdr: %s, params: %s, data: %s", hdr, parameters, data);
}

12
testing/btest/scripts/base/protocols/smb/smb1-transaction-secondary-request.test Normal file
View file

@ -0,0 +1,12 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_secondary_request.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/smb
@load policy/protocols/smb
# Check that smb1_transaction_secondary requests are parsed correctly
event smb1_transaction_secondary_request(c: connection, hdr: SMB1::Header, args: SMB1::Trans_Sec_Args, parameters: string, data: string)
{
print fmt("smb1_transaction_secondary_request hdr: %s, args: %s, params: %s, data: %s", hdr, args, parameters, data);
}

12
testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test Normal file
View file

@ -0,0 +1,12 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction2_request.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/smb
@load policy/protocols/smb
# Check that smb1_transaction2 requests are parsed correctly
event smb1_transaction2_request(c: connection, hdr: SMB1::Header, args: SMB1::Trans2_Args, sub_cmd: count)
{
print fmt("smb1_transaction2_request hdr: %s, args: %s, sub_cmd: %x", hdr, args, sub_cmd);
}

12
testing/btest/scripts/base/protocols/smb/smb1-transaction2-secondary-request.test Normal file
View file

@ -0,0 +1,12 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction2_secondary_request.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/smb
@load policy/protocols/smb
# Check that smb1_transaction2_secondary requests are parsed correctly
event smb1_transaction2_secondary_request(c: connection, hdr: SMB1::Header, args: SMB1::Trans2_Sec_Args, parameters: string, data: string)
{
print fmt("smb1_transaction2_secondary_request hdr: %s, args: %s, params: %s, data: %s", hdr, args, parameters, data);
}