Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

add test for smb1_com_transaction_request event changes

Browse source
This commit is contained in:
Jeffrey Bencteux 2018-01-12 15:35:44 +01:00
parent 00be145b1b
commit 6d497ea8b0
3 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-request/.stdout Normal file
View file

@ -0,0 +1 @@
smb1_transaction_request hdr: [command=37, status=0, flags=0, flags2=0, tid=31335, pid=1, uid=11132, mid=2], name: \\PIPE\lsarpc, sub_cmd: 2600, params: some_params, data: some_data

BIN
testing/btest/Traces/smb/smb1_transaction_request.pcap Normal file
View file

Binary file not shown.

12
testing/btest/scripts/base/protocols/smb/smb1-transaction-request.test Normal file
View file

@ -0,0 +1,12 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_request.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/smb
@load policy/protocols/smb
# Check that smb1_transaction requests are parsed correctly
event smb1_transaction_request(c: connection, hdr: SMB1::Header, name: string, sub_cmd: count, parameters: string, data: string)
{
print fmt("smb1_transaction_request hdr: %s, name: %s, sub_cmd: %x, params: %s, data: %s", hdr, name, sub_cmd, parameters, data);
}