Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

RDP: cookie is optional

Browse source 
Fixes GH-4237
This commit is contained in:
Johanna Amann 2025-02-20 09:36:18 +01:00
parent 27bfd5b4a8
commit 72ea7fc06c
8 changed files with 60 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/Baseline/scripts.base.protocols.rdp.rdp-no-cookie-msthash/rdp.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path rdp
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p cookie result security_protocol client_channels keyboard_layout client_build client_name client_dig_product_id desktop_width desktop_height requested_color_depth cert_type cert_count cert_permanent encryption_level encryption_method
#types time string addr port addr port string string string vector[string] string string string string count count string string count bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.128.36.245 50204 10.132.153.76 3389 (empty) encrypted HYBRID_EX - - - - - - - - - 0 - - -
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.protocols.rdp.rdp-no-cookie-msthash/ssl.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path ssl
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher curve server_name resumed last_alert next_protocol established ssl_history cert_chain_fps client_cert_chain_fps subject issuer sni_matches_cert
#types time string addr port addr port string string string string bool string string bool string vector[string] vector[string] string string bool
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.128.36.245 50204 10.132.153.76 3389 TLSv12 TLS_RSA_WITH_AES_256_GCM_SHA384 - - F - - T CsxnGIi 2f24fa5efe1c62447b32aa41af38c4176d03a62ca9c3c8d491946ed283b86cca (empty) CN=CLK-456040-D.one.phoenix.gov CN=CLK-456040-D.one.phoenix.gov -
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/rdp/rdp-no-cookie-mstshash.pcap Normal file
View file

Binary file not shown.

12
testing/btest/scripts/base/protocols/rdp/rdp-no-cookie-msthash.zeek Normal file
View file

@ -0,0 +1,12 @@
# Test a trace that does not have a cookie field.
# @TEST-EXEC: zeek -b -r $TRACES/rdp/rdp-no-cookie-mstshash.pcap %INPUT
# @TEST-EXEC: btest-diff rdp.log
# @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: test ! -f analyzer.log
# @TEST-EXEC: test ! -f dpd.log
@load base/protocols/rdp
@load base/protocols/ssl
redef SSL::log_include_server_certificate_subject_issuer=T;