mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
smb/dce-rpc: Cleanup DCE-RPC analyzers when fid is closed and limit them
This patch does two things: 1) For SMB close requests, tear down any associated DCE-RPC analyzer if one exists. 2) Protect from fid_to_analyzer_map growing unbounded by introducing a new SMB::max_dce_rpc_analyzers limit and forcefully wipe the analyzers if exceeded. Propagate this to script land as event smb_discarded_dce_rpc_analyzers() for additional cleanup. This is mostly to fix how the binpac SMB analyzer tracks individual DCE-RPC analyzers per open fid. Connections that re-open the same or different pipe may currently allocate unbounded number of analyzers. Closes #3145.
This commit is contained in:
parent
1c9038f38d
commit
6517ed94f2
7 changed files with 61 additions and 1 deletions
|
@ -211,6 +211,7 @@ export {
|
|||
["spontaneous_RST"] = ACTION_IGNORE,
|
||||
["SMB_parsing_error"] = ACTION_LOG,
|
||||
["SMB_discarded_messages_state"] = ACTION_LOG,
|
||||
["SMB_discarded_dce_rpc_analyzers"] = ACTION_LOG,
|
||||
["no_smb_session_using_parsesambamsg"] = ACTION_LOG,
|
||||
["smb_andx_command_failed_to_parse"] = ACTION_LOG,
|
||||
["smb_tree_connect_andx_response_without_tree"] = ACTION_LOG_PER_CONN,
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue