Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Changes proposed in #104

Browse source
This commit is contained in:
John E. Rollinson 2017-09-17 14:59:41 -04:00
parent 6ffa99d67e
commit 5afde3f0e5
2 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/analyzer/protocol/gssapi/gssapi-analyzer.pac
View file

@ -28,8 +28,8 @@ refine connection GSSAPI_Conn += {
function forward_blob(val: GSSAPI_NEG_TOKEN_MECH_TOKEN, is_orig: bool): bool
%{
if ( ${val.mech_token}.length() >= 7 &&
memcmp("NTLMSSP", ${val.mech_token}.begin(), 7) == 0 )
if ( val->oid()->meta()->length() >= 7 &&
memcmp("NTLMSSP", val->oid()->content().begin(), 7) == 0 )
{
// ntlmssp
if ( ! ntlm )
@ -38,9 +38,9 @@ refine connection GSSAPI_Conn += {
if ( ntlm )
ntlm->DeliverStream(${val.mech_token}.length(), ${val.mech_token}.begin(), is_orig);
}
else if ( ${val.mech_token}.length() == 9 &&
(memcmp("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02", ${val.mech_token}.begin(), ${val.mech_token}.length()) == 0 ||
memcmp("\x2a\x86\x48\x82\xf7\x12\x01\x02\x02", ${val.mech_token}.begin(), ${val.mech_token}.length()) == 0 ) )
else if ( val->oid()->meta()->length() == 9 &&
(memcmp("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02", val->oid()->content().begin(), val->oid()->meta()->length()) == 0 ||
memcmp("\x2a\x86\x48\x82\xf7\x12\x01\x02\x02", val->oid()->content().begin(), val->oid()->meta()->length()) == 0 ) )
{
// krb5 && ms-krb5
if ( ! krb5 )

4
src/analyzer/protocol/gssapi/gssapi-protocol.pac
View file

@ -51,6 +51,8 @@ type GSSAPI_NEG_TOKEN_RESP_Arg = record {
type GSSAPI_NEG_TOKEN_MECH_TOKEN(is_orig: bool) = record {
meta : ASN1EncodingMeta;
mech_token : bytestring &length=meta.length;
mech_token_meta : ASN1EncodingMeta;
oid : ASN1Encoding;
mech_token : bytestring &restofdata;
};