Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Changes proposed in #104

Browse source
This commit is contained in:
John E. Rollinson 2017-09-17 14:59:41 -04:00
parent 6ffa99d67e
commit 5afde3f0e5
2 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/analyzer/protocol/gssapi/gssapi-analyzer.pac
View file

@ -28,8 +28,8 @@ refine connection GSSAPI_Conn += {
function forward_blob(val: GSSAPI_NEG_TOKEN_MECH_TOKEN, is_orig: bool): bool function forward_blob(val: GSSAPI_NEG_TOKEN_MECH_TOKEN, is_orig: bool): bool
%{ %{
if ( ${val.mech_token}.length() >= 7 && if ( val->oid()->meta()->length() >= 7 &&
memcmp("NTLMSSP", ${val.mech_token}.begin(), 7) == 0 ) memcmp("NTLMSSP", val->oid()->content().begin(), 7) == 0 )
{ {
// ntlmssp // ntlmssp
if ( ! ntlm ) if ( ! ntlm )
@ -38,9 +38,9 @@ refine connection GSSAPI_Conn += {
if ( ntlm ) if ( ntlm )
ntlm->DeliverStream(${val.mech_token}.length(), ${val.mech_token}.begin(), is_orig); ntlm->DeliverStream(${val.mech_token}.length(), ${val.mech_token}.begin(), is_orig);
} }
else if ( ${val.mech_token}.length() == 9 && else if ( val->oid()->meta()->length() == 9 &&
(memcmp("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02", ${val.mech_token}.begin(), ${val.mech_token}.length()) == 0 || (memcmp("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02", val->oid()->content().begin(), val->oid()->meta()->length()) == 0 ||
memcmp("\x2a\x86\x48\x82\xf7\x12\x01\x02\x02", ${val.mech_token}.begin(), ${val.mech_token}.length()) == 0 ) ) memcmp("\x2a\x86\x48\x82\xf7\x12\x01\x02\x02", val->oid()->content().begin(), val->oid()->meta()->length()) == 0 ) )
{ {
// krb5 && ms-krb5 // krb5 && ms-krb5
if ( ! krb5 ) if ( ! krb5 )

4
src/analyzer/protocol/gssapi/gssapi-protocol.pac
View file

@ -51,6 +51,8 @@ type GSSAPI_NEG_TOKEN_RESP_Arg = record {
type GSSAPI_NEG_TOKEN_MECH_TOKEN(is_orig: bool) = record { type GSSAPI_NEG_TOKEN_MECH_TOKEN(is_orig: bool) = record {
meta : ASN1EncodingMeta; meta : ASN1EncodingMeta;
mech_token : bytestring &length=meta.length; mech_token_meta : ASN1EncodingMeta;
oid : ASN1Encoding;
mech_token : bytestring &restofdata;
}; };