Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'jeff-bb/patch-2'

Browse source 
* jeff-bb/patch-2:
  Log raw keyboard value on best guess
  Avoid excessive fmt calls, return default behavior on unknown
  "Best Guess" unknown keyboard / language variants
This commit is contained in:
Tim Wojtulewicz 2023-01-23 12:48:06 -07:00
commit 6cfb45d24f
3 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/protocols/rdp/main.zeek
View file

@ -187,7 +187,18 @@ event rdp_client_core_data(c: connection, data: RDP::ClientCoreData) &priority=5
{
set_session(c);
c$rdp$keyboard_layout = RDP::languages[data$keyboard_layout];
if (data$keyboard_layout in RDP::languages)
{
c$rdp$keyboard_layout = RDP::languages[data$keyboard_layout];
}
else
{
if (data$keyboard_layout & 0xffff in RDP::languages)
c$rdp$keyboard_layout = fmt("%s (Best Guess for %d)", RDP::languages[data$keyboard_layout & 0xffff], data$keyboard_layout);
else
c$rdp$keyboard_layout = fmt("keyboard-%d", data$keyboard_layout);
}
c$rdp$client_build = RDP::builds[data$client_build];
c$rdp$client_name = data$client_name;
c$rdp$client_dig_product_id = data$dig_product_id;