Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'nfs_changes' of https://github.com/jwallior/bro

Browse source 
* 'nfs_changes' of https://github.com/jwallior/bro:
  Add nfs unittest. Includes an example for the new nfs_proc_rename.
  Added rename event to rpc/nfs protocol analyzer. 	This event identifies and reports information 	about nfs/rpc calls and replies of the type 	rename.
  Expand parsing of RPC Call packets to add Uid, Gid, Stamp, MachineName and AuxGIDs
  Fix NFS protocol parser.
This commit is contained in:
Jon Siwek 2017-05-22 20:32:32 -05:00
commit 5540b228e5
12 changed files with 235 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

30
scripts/base/init-bare.bro
View file

@ -2142,6 +2142,16 @@ export {
rep_dur: interval;
## The length in bytes of the reply.
rep_len: count;
## The user id of the reply.
rpc_uid: count;
## The group id of the reply.
rpc_gid: count;
## The stamp of the reply.
rpc_stamp: count;
## The machine name of the reply.
rpc_machine_name: string;
## The auxiliary ids of the reply.
rpc_auxgids: index_vec;
};
## NFS file attributes. Field names are based on RFC 1813.
@ -2172,6 +2182,16 @@ export {
fname: string; ##< The name of the file we are interested in.
};
## NFS *rename* arguments.
##
## .. bro:see:: nfs_proc_rename
type renameopargs_t : record {
src_dirfh : string;
src_fname : string;
dst_dirfh : string;
dst_fname : string;
};
## NFS lookup reply. If the lookup failed, *dir_attr* may be set. If the
## lookup succeeded, *fh* is always set and *obj_attr* and *dir_attr*
## may be set.
@ -2264,6 +2284,16 @@ export {
dir_post_attr: fattr_t &optional; ##< Optional attributes associated w/ dir.
};
## NFS reply for *rename*. Corresponds to *wcc_data* in the spec.
##
## .. bro:see:: nfs_proc_rename
type renameobj_reply_t: record {
src_dir_pre_attr: wcc_attr_t;
src_dir_post_attr: fattr_t;
dst_dir_pre_attr: wcc_attr_t;
dst_dir_post_attr: fattr_t;
};
## NFS *readdir* arguments. Used for both *readdir* and *readdirplus*.
##
## .. bro:see:: nfs_proc_readdir