Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 02:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add success indicator to the ntlm.log.

Browse source 
This changes the single gssapi event slightly too.
This commit is contained in:
Seth Hall 2016-04-13 12:09:05 -04:00
parent b4b9fbb8d2
commit 5d33ac773b
4 changed files with 55 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/analyzer/protocol/gssapi/gssapi-protocol.pac
View file

@ -32,8 +32,6 @@ type GSSAPI_NEG_TOKEN_INIT_Arg_Data(index: uint8) = case index of {
1 -> req_flags : ASN1Encoding;
2 -> mech_token : bytestring &restofdata;
3 -> mech_list_mic : ASN1OctetString;
} &let {
fwd: bool = $context.connection.forward_ntlm(mech_token, true) &if(index==2);
};
type GSSAPI_NEG_TOKEN_RESP = record {
@ -43,14 +41,10 @@ type GSSAPI_NEG_TOKEN_RESP = record {
type GSSAPI_NEG_TOKEN_RESP_Arg = record {
seq_meta : ASN1EncodingMeta;
args : GSSAPI_NEG_TOKEN_RESP_Arg_Data(seq_meta.index) &length=seq_meta.length;
};
type GSSAPI_NEG_TOKEN_RESP_Arg_Data(index: uint8) = case index of {
0 -> neg_state : ASN1Integer;
1 -> supported_mech : ASN1Encoding;
2 -> response_token : bytestring &restofdata;
3 -> mech_list_mic : ASN1OctetString;
} &let {
fwd: bool = $context.connection.forward_ntlm(response_token, false) &if(index==2);
args : case seq_meta.index of {
0 -> neg_state : ASN1Integer;
1 -> supported_mech : ASN1Encoding;
2 -> response_token : bytestring &restofdata;
3 -> mech_list_mic : ASN1OctetString;
} &length=seq_meta.length;
};