Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Correct endianness of IP addresses in SNMP.

Browse source 
Addresses BIT-1644
This commit is contained in:
Johanna Amann 2016-07-26 15:02:11 -07:00
parent 51b8dee70b
commit 7603567782
5 changed files with 47 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/snmp/snmp-analyzer.pac
View file

@ -39,7 +39,7 @@ AddrVal* network_address_to_val(const ASN1Encoding* na)
const u_char* data = reinterpret_cast<const u_char*>(bs.data());
uint32 network_order = extract_uint32(data);
return new AddrVal(network_order);
return new AddrVal(ntohl(network_order));
}
Val* asn1_obj_to_val(const ASN1Encoding* obj)

30
testing/btest/Baseline/scripts.base.protocols.snmp.snmp-addr/.stdout Normal file
View file

@ -0,0 +1,30 @@
138.68.0.1
138.68.14.240
169.254.169.254
10.46.0.5
127.0.0.1
138.68.10.203
255.255.0.0
255.0.0.0
255.255.240.0
0.0.0.0
10.46.0.0
138.68.0.0
138.68.0.1
0.0.0.0
0.0.0.0
0.0.0.0
255.255.0.0
255.255.240.0
138.68.0.1
138.68.14.240
169.254.169.254
0.0.0.0
10.46.0.0
138.68.0.0
0.0.0.0
255.255.0.0
255.255.240.0
138.68.0.1
0.0.0.0
0.0.0.0

2
testing/btest/Baseline/scripts.base.protocols.snmp.v1/out4
View file

@ -3,7 +3,7 @@ snmp_trap
is_orig: T
[community=public]
enterprise: 1.3.6.1.4.1.31337.0
agent: 1.0.0.127
agent: 127.0.0.1
generic_trap: 0
specific_trap: 0
time_stamp: 0

BIN
testing/btest/Traces/snmp/snmpwalk-short.pcap Normal file
View file

Binary file not shown.

15
testing/btest/scripts/base/protocols/snmp/snmp-addr.bro Normal file
View file

@ -0,0 +1,15 @@
# @TEST-EXEC: bro -C -b -r $TRACES/snmp/snmpwalk-short.pcap %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/snmp
event snmp_response(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) {
for (i in pdu$bindings) {
local binding = pdu$bindings[i];
if (binding$value?$address)
print binding$value$address;
}
}