Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Move some of the last DCE_RPC scripts out of SMB scripts.

Browse source
This commit is contained in:
Seth Hall 2016-04-03 15:48:47 -04:00
parent 143eee5d8d
commit 68d0f697eb
3 changed files with 15 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/protocols/smb/__load__.bro
View file

@ -2,7 +2,6 @@
@load ./const-dos-error
@load ./const-nt-status
@load ./main
@load ./pipe
@load ./smb1-main
@load ./smb2-main
@load ./files

52
scripts/base/protocols/smb/pipe.bro
View file

@ -1,52 +0,0 @@
module SMB;
export {
redef enum Log::ID += {
ATSVC_LOG,
};
type ATSvcInfo: record {
ts : time &log; ##< Time of the request
uid : string &log; ##< UID of the connection
id : conn_id &log; ##< Connection info
command : string &log; ##< Command (add, enum, delete, etc.)
arg : string &log; ##< Argument
server : string &log; ##< Server the command was issued to
result : string &log &optional; ##< Result of the command
};
}
redef record SMB::State += {
pipe_atsvc: ATSvcInfo &optional;
};
event bro_init() &priority=5
{
Log::create_stream(ATSVC_LOG, [$columns=ATSvcInfo]);
}
event smb_atsvc_job_add(c: connection, server: string, job: string) &priority=5
{
local info = ATSvcInfo($ts=network_time(),
$uid = c$uid,
$id = c$id,
$command = "Add job",
$arg = job,
$server = server);
c$smb_state$pipe_atsvc = info;
}
event smb_atsvc_job_id(c: connection, id: count, status: count) &priority=5
{
if ( c$smb_state?$pipe_atsvc )
c$smb_state$pipe_atsvc$result = (status==0) ? "success" : "failed";
}
event smb_atsvc_job_id(c: connection, id: count, status: count) &priority=-5
{
if ( c$smb_state?$pipe_atsvc )
{
Log::write(ATSVC_LOG, c$smb_state$pipe_atsvc);
delete c$smb_state$pipe_atsvc;
}
}