From 6d497ea8b05d712f5c35f403f9854ea0e4310c82 Mon Sep 17 00:00:00 2001
From: Jeffrey Bencteux <jeffrey.bencteux@ssi.gouv.fr>
Date: Fri, 12 Jan 2018 15:35:44 +0100
Subject: [PATCH] add test for smb1_com_transaction_request event changes

---
 .../.stdout                                      |   1 +
 .../Traces/smb/smb1_transaction_request.pcap     | Bin 0 -> 1731 bytes
 .../protocols/smb/smb1-transaction-request.test  |  12 ++++++++++++
 3 files changed, 13 insertions(+)
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout
 create mode 100644 testing/btest/Traces/smb/smb1_transaction_request.pcap
 create mode 100644 testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test

diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout
new file mode 100644
index 0000000000..b9d6e354ee
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout
@@ -0,0 +1 @@
+smb1_transaction_request hdr: [command=37, status=0, flags=0, flags2=0, tid=31335, pid=1, uid=11132, mid=2], name: \\PIPE\lsarpc, sub_cmd: 2600, params: some_params, data: some_data
diff --git a/testing/btest/Traces/smb/smb1_transaction_request.pcap b/testing/btest/Traces/smb/smb1_transaction_request.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..e234ec4e76f2ce3c8b2e3b7db28c5d4429e42c05
GIT binary patch
literal 1731
zcmb7DT}V?=9RJ_D8P=TnK{0}8V47e}9m7BhEYn&wyR?;I%XXcXqn5TAMrEvsP^^b2
zk)EQDL0zziK%)mkum|bIhk}UMz_g+Vi5gf2b^HI%ans!^!4CWn=bn$>{e7JCcKq3W
z5sZ**stO?B$FaU6O*6BrpbE!Sum8UM79WZaQJ)QU0Hw68X2tx)vBw}_iIWLoG>IaK
zR@fHjC@P{<;{p{w&#@TFX2d|07v~9qkc836M0DiQ7ThfO3KZpVGk|DR-w~fsnJIHV
z0;1WZJS+V8%K7~4F+l*~sdTE2E~wh0QN>X#Rw#Uc#{kMzw`*sJMi%OpHgZn{$N{mz
zW8LqvR@f@-%uez0B7L0^rLm7>#D}{YBW#G~kn$9zJ%`i35;4I&oTSpB+=@*zl=5X!
zEQ(^8z+(VyDf+#J8a9*aIQ@J8gB`sv?w|z$DslQxA_9IzIeWAJjqpm%wnA-i)0%6_
zx?&IB2RC?d<6bs$gOhFu6TP;^oOxyr%xsWl=He)Q*Uj)85vg>UJ>i-C`mM=~qhMw(
zyhGS}NOYJ+781F%anWWKe9&&PFRUaVMHYS+fh32+yARd5QD$S{OlwDX*y^xVq>YXE
zb})JY3IM#`MrVV4pVukXZUpR@8Mph*5WziEy6i%+8J3+(lieV09+oUa6Hjm82%tVC
zqu0PD7CQkhm5E>=8Un0OajUXbf?E!@$jErB%>f=#(Toquw}C(Ij2`$fhBHOse7_0|
zCGH34#$QtD!U^zj=BqW~a1;zDl3@I|ld5xUsO`8aW-jSk&Ri0+>jXeMo~6>6+Z6l6
z%x%?}JB6F)$lR83_FG$uMkL+blNZv=&0?7{`3H)`%y0NybR=5HOkB-PoINGNL!>~Z
zGjU+S#9WPu90g4r>tXBz#J-pf)4L@5TobHJUjY*w#5o_{TPRW061=#QQ>ycx4$GlV
zKR~!6*mk^A4#`1!Iqa)d?vlxHrE5{R&hXOMXJ+_7y5Z46jL<LTqv7wl@cQW$Df^Z|
L`NB}{{14?HBVz{M

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test b/testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test
new file mode 100644
index 0000000000..9334230e84
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test
@@ -0,0 +1,12 @@
+#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_request.pcap %INPUT
+#@TEST-EXEC: btest-diff .stdout
+
+@load base/protocols/smb
+@load policy/protocols/smb
+
+# Check that smb1_transaction requests are parsed correctly
+
+event smb1_transaction_request(c: connection, hdr: SMB1::Header, name: string, sub_cmd: count, parameters: string, data: string)
+{
+	print fmt("smb1_transaction_request hdr: %s, name: %s, sub_cmd: %x, params: %s, data: %s", hdr, name, sub_cmd, parameters, data);
+}