From b2a2ad7e1019d9a2d889b024128c431f67b45c6e Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Fri, 8 Aug 2025 15:42:15 +0200 Subject: [PATCH] smb2/read: Parse only 1 byte for data_offset, ignore reserved1 A user provided a SMB2 pcap with the reserved1 field of a ReadResponse set to 1 instead of 0. This confused the padding computation due to including this byte into the offset. Properly split data_offset and reserved1 into individual byte fields. Closes #4730 --- src/analyzer/protocol/smb/smb2-com-read.pac | 5 +++-- .../files.log | 11 +++++++++++ testing/btest/Traces/README | 3 +++ .../smb/smb_v2_only_non_zero_reserved1.pcap | Bin 0 -> 40934 bytes .../smb2-read-response-non-zero-reserved1.test | 9 +++++++++ 5 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-response-non-zero-reserved1/files.log create mode 100644 testing/btest/Traces/smb/smb_v2_only_non_zero_reserved1.pcap create mode 100644 testing/btest/scripts/base/protocols/smb/smb2-read-response-non-zero-reserved1.test diff --git a/src/analyzer/protocol/smb/smb2-com-read.pac b/src/analyzer/protocol/smb/smb2-com-read.pac index d9b2d7cf7f..4f0e7548ed 100644 --- a/src/analyzer/protocol/smb/smb2-com-read.pac +++ b/src/analyzer/protocol/smb/smb2-com-read.pac @@ -93,10 +93,11 @@ type SMB2_read_request(header: SMB2_Header) = record { type SMB2_read_response(header: SMB2_Header) = record { structure_size : uint16; - data_offset : uint16; + data_offset : uint8; + reserved1 : uint8; data_len : uint32; data_remaining : uint32; - reserved : uint32; + reserved2 : uint32; pad : padding to data_offset - header.head_length; data : bytestring &length=data_len; } &let { diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-response-non-zero-reserved1/files.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-response-non-zero-reserved1/files.log new file mode 100644 index 0000000000..fe939ef5e9 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-response-non-zero-reserved1/files.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path files +#open XXXX-XX-XX-XX-XX-XX +#fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid +#types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string +XXXXXXXXXX.XXXXXX FmcSEk2dq4v0hewpM4 CHhAvVGS1DHFjwGM9 172.31.112.17 57829 172.31.112.16 445 SMB 0 (empty) text/plain Test.txt 0.000000 T F 189 189 0 0 F - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/README b/testing/btest/Traces/README index ec244576a9..a01d06902b 100644 --- a/testing/btest/Traces/README +++ b/testing/btest/Traces/README @@ -53,3 +53,6 @@ Trace Index/Sources: - ldap/adduser1.pcap ldap/adduser1-ntlm.pcap Provided by Mohan-Dhawan on #4275 https://github.com/zeek/zeek/issues/4275 +- smb_v2_only_non_zero_reserved1.pcap + Provided by @predator89090 on #4730 + https://github.com/zeek/zeek/issues/4730 diff --git a/testing/btest/Traces/smb/smb_v2_only_non_zero_reserved1.pcap b/testing/btest/Traces/smb/smb_v2_only_non_zero_reserved1.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a30eecffe3fc85ffcfdde0f4ffebfb8a89cc35ce GIT binary patch literal 40934 zcmeHQ2Y6IP*Ph+%hL8YhOO>*erAZ(SNB|*)5(0!I^cqU&kc3bKrG$V+{6G{%X#y%1 zL_rY&Q8d^9jRpA-grHPGKmiLNqWtHbyOX^;d-v`_z8~~?oPB2R-CNF_^PV&3oS9qp zzaMOR#>h;}QB2H0KVDuxZq&deBTJxlRDWZIhT-q~8xIVA%IL>B7+JKfTpY{uW$cw& zIl)wej-4{>h_bXe0ZMuAU%MDnz?jiw-fZyk@iQ1qMo>JNs-_593SEU_+Lxf1^BAas zs$s{mQ^f_fl8EZby!0D4&j0F4v0R#wwV)PJB_0`TXe+PD<4L00IW@>?iMd~qG?A#x zCJLw$6(gHytDr-r3Q_rxPGhXYjUL?+ajZyFKF zjC8m)vT1mD$!fcH?Ktp#dm33AIs;XKyaXl^Ds3-^X_W+1=O|0dFbGwCy=WMaPa#^7 zq)}9fmeEiz?JLmAUad)sL|a#j)4KW>@fs({l7YZPZl=W388?iK{gpZRp^Vr|o#ubC zY2Uu9kH1%j6Un1*rB1jp^*_scA1)!E$ENWkhD`PKz1!DdHXGNB4eeb{~BTW99bHUgI!jX_4{ zWAq93VRUSLPQk#ew4QZ+>i+1<|Jk(gSdR+{3oE>B{cb=}*BV_5%eFbR`$pNwbevCp z88ql);8u94myu-=d#Em!GbC*vx13?lmSgQeR`?y{{;M^p8KRx#c36(La>H_heT*)a z(+uS8R)eLM}7%=e{vM znF-uYTp|Ol!RjXUGqPgZg6d**pWA|fzU+Kkepg&jdnTbD5?h-SdsabT!P>xTvmm}1 zttrKm)m0@G3QhH8$@a4d)ufXC*fzY)nhN3N)IIFk#-@fTJ-c@6(Ib_#$JkT(e#c8r zwXgWI;T>o-5VCIVZ)6kbKvWk?%Sih#WX+Z=t@g|)OUwhXv{k==q#;VkT8Xhj*jcc> zC0SM*wl@({*$<*cS*l6w9D8QYneaKM*7*1v49_@=HRlV{oFX9@$okSJhL#oc=O5qp z=+>x-OO8KIKY4kCJ;K`3nh>-H>rEeYGiA-dDzQGSGfQD%_AOy7l_jzWGK3H|iA|+X zQ#PJuv*BzgEqz#Hb}t*lvgmkaZy3v=eGzn&>(ORS8fBQDQ%3>#*9REcE)oV+HZUcKa z7-Y&fmJ=!f@hbG$K+6_}7KV>$S(83}X<3avQ|-SWrDYI(u9MO$=09{?sATx|7i`_j zRJZ+hA+hqx`z!1b>gY^Ljij_EhQLiB<#eS_GK*)KYywxn7y^7U%O$l;CiUc&s8Rbo zYFx9dXPehN)9UE11E1{ZJ8$}ze~FGJJlV*uXNGM5?d7*{^54g7e91ha9X}RMA620r zPkwE=d~w#)d){reaLTJK7Qb51G54XTY6V6IZ~48}mIbXY`j_}0$9ZL0Ju>1kY$RdY zjPPzr$TwwC+^i$$8^0oWdZ(PzC}_r|nOSdtKK;@QkKb52HQ>1rQxN*H`Ng7huY6s! z0!P8DJB>85)wGT(`xN$A+J2aIPBZ7|RcCXQrFA7T>!5EofesrXn>Cp!FYe6xwFWCY zKRspmXTHBLdbi5qRWlWzQiDBnS9n#JFca)vcrxemx6>Oh05!0?b`-gNtW%YHAzNt+ z(dvb*D-{>itpRppE`ScpQM2nq{jdt(%t&QQk$d4Ecjce`=))hcwS9Ex^Kp?aG8J|k zvVrt*uZn@>wcx4hanAdWHnN9_JgN)OGt$21Kqoo_UAG1S{V+J+eTZ|GDswJ?R&x$D z3;(h3@b?2gK45y{+~hQ$rAK~_2_mBu=6J(U%K%Il6KBvPstcxTZK0Z&K1`TSj&(UvYRvBvieWYzp(jFqiL6!TBp(yPDq|N$S z>NgXkENy(rIs;EqmP1Idk##HjjXUdnyi%v>+y3J_^@LBuqR&UXyf%WUXjx|t$Wy^G z9Oi8=OKDkwYRRUP0W>^ftg?OoUwO*Pxa4~Ge|6uet@h2gWue6vcmsyFg#nF5VAs=0 z)A_UyRn|0{oOTeJ>x|XxP7xKIX^L;STu(}J4UMwg(;HL_W5EpyI07vlj1F;H zoiu6DG{x{_PRK1r-u8VpM)6~f>=h!5Dq&<~t8A6sV)QC$%@T8obCfHzhF|K4?8kR2 z-UzEAt~Jk?JbY`|hEW*}-ijO6wBZOPA~*IJksZDiXqFkL8BK7dd?xv9Fq#pbBcx`wkn#a z78MuNHxOr`v2Oq?F{z;VAWVydV>1<@Kg47;XUbm3H$^neM!A$Z_5>C70_s+(h-`UO zH&YcQhE{?Ya+50jnD$ALX=0yxxl5X;siHa$$90<)KO9SWds@danb?jZ+KHz1^od<3 zVOyg|noi0{zEtOdv7cw%Gwg>{Vc*#2uD~t^jW@FUNHA2{6B)**6$Ab3Zq9a5-wCfxhrW-lE@+-B8e7@Ecn~lYO0Pe0u#UjioG!aN=>aqYF5(FPGBt zC8}1c0xj66K$ljz{iUk*>!B%#ZyZgv990xgeAQNBj?0K-2M)-zN|P%1Hp>eP6Y^lKnUuLI==&gIgdJf+s4hKEQv2;)Ok5x zp`_6Ik!UTZ4XARIW%Fz`w6u}<=DbrN;}G>E$=FAd(0A9w({7*X2=|hjNMxff%mNzNO5?Ik^M{rP+g=rnRX0P zWPd41@n)1ok)oy&0=KE95D^kwdFwYy8zB>@E$9ax@n#~V7YH2Z2z=p;z}+<4ryx+N zJ2gq^fI9@d?f0ccAd#4WtEEGQd`9eW&hANpG=8b)SVH-3&t8q9 zbV=m1pTZYK(P^iER`v|Z z3O*t$_=!AhXs^ZK$KWTUB|NORXq9$Oq&;zg9to=xJu`>atyBeCTG>18F4?b#CUQ%? z0yI&8Xl8$tUR1Se+TTyb1z~%EsHdoEQ5y1?ONgi{BLfa22blDt>i6IxwxQd8l;Hjm&y&*Wy=k> z<12D5PdS^relE`;S&8m6s(DmbQWYhJR)mFGY2Dpi>K9(l8G){#r)SZg=1gJHK-vEh zUH@Z z4-P1~7U3<2rS-uLmzmg9auukuEgMGL>S^KJDYCdAyfdVTeH%a;+Nf>WOmjHGmIZ#L z^}%MeLN$|F$p;6qhiH8>Re7$+TVK4_OJ5BBg)gSnk}D)w7u(f7+V9}fLZ6Dy_s*Lg zZ4Ia!65-AKJ*<7mauZul0;0O)a0}ATLJQfooNXzbZkSKXB`pM+zX3mnA+i=k|MXT1 z!bf|W;VVRQRK!f5mH%R_BQ4>ZtJ;@KX}O!Km8w7seO#Rh>}w27^!b5P~}!k)I-wE9a@ZgD{buBr#dT%^+& zo2b^5AC1RFe*tnRp887!OEn1ealDK?wmB8BewbMAL>QsE7+GxEIc{VVosBGlE~+P; z2J4mX0zpH0nRQ`g-m)GnvEF{@Ph0`4SDvB#il9Mtv506}eaRxu7_b4#EYNfcX9i>MNh zxL>A$CXdsIYMgppet4~#FX!2FdY-DGMCAv=j`?Q|6ZItB^t_s)i=;ntNhhl${oz=5 z<8`8%3rSA|xk|d5DC$VsNR!80qWY&=()^dye7Q*4SfX;)u;ZN-b>7jFbl5sIMHfkb z;*w5MNqROTbJ=@Dbq6H9ueGbBQ;4FDq<3rbxPzz`swKVrnn~{t%_b5R#d;OXz+6jR z$n1QFCR078!S~V^{Fz>eXlNgu11US z#R>biPyBxLX917ST-Rp9o*6jLL}!xQqBZn`s;}!x8zxDs=vBe&j!PSC8tr=`{`E_# z11j$slo{2e^Dn(C6>d0ObJjCQ($|g4spKkcjJ~u@C25uZs`Q0BF7259V}7f;sm_Rn zpGVhST>be8D}4@}$*r@e=f%yl=N658n^Fr|xA(kZQr(&5+`|k*(k?*S?2f7)2Co^n zY)exsg*VIPx!g|dk9&zs!toFeHzWG;WXaw>?)Cdy^B$8Q6ue6G{~nKf)%q}f(!smV zEhxID-A4i4D(+ldXI0s9xhtQ#vAqAR1H&K8bw$6eKKd6q`W;m0!@m{2v!d<@p#N~M zf6?a%Fe~}0oL9^Ko_=)Gy@S6Cc=5m&GZwvj<+pnetTy{q|Ly%c6SMkVc13@wKKhq9 z`s(|C5J&%VFZvGj`}F(ibAz?P;5FrsK6`$9y=Dy-d_1#PV>8Lm@~BdGL`LTFtAu{2yGI?xs7?4H;dyLem97kZS8meDjav>K z3jOG6_k)MKE~-jTI*Mcee;##21ih{=Yq%sU&lj3n_a*k5_Ro{`k1Zy>$2xy@=~Wa_ z`c0#V@-bx17|CtQ<*`mNP!hV5_1d%R^0w|PIW+pp;g(c3;r)0eDz~l6i}95eP>0z0D%A9i;&gznOaZaw`)DWb>I5$ z?*IPu?yI$$Klp7a!H@p6PLs_MOV5KDlz$5NbGMoFo~ez{?ByTtOYFaqzz=cvOs()} zVircW{N?rMY+Lp8sxz-9w0LU%w1xLMd$im1Ol{@X_pa}kpOQTL((}plevfT(d!MO2 zR^!RJ8@A0pbgkMan*xu9S%pUzy<^6!OMD-GqS`|+raS*kt>EfTKU14AseRF(8#lFh zd-9Ugryfc16A!6w+O=)&vWrRY0WJ8H1^Q+kDVa47)b#=~GFLV$jahf;c>RMi@8v|_ z(`w4cPgkE~y(4D5x7E<5tFFY4e*5WPyJR;hQ~mau_1$GozEiaJ23v6Vy$ds1cP*05 zdQMS?RZ~Zf!gR*JW(^Q{Isa3+lt(PV`!~*+l0NI{THA$L?+7}xqkh3Rf9TUr?)CpCZ$ut@=ZPAjf{GCoor;7_B-z8Zsv0H(e zAx1rkO_PXx{vGp7)v%iiA``ATiCmj+RDCsKhB7S9_1ddE4==Zas~c#C&!yASi*_pA zd^;6O?)B=$A_ugvGTKAuPeaX_P?*2nEeV3WGARb`ZU%wHK(y=A*}7_!ytY0 ziP>AB@5N4j?LzgLj2O)`Rk^*2B~LJT z+dI*oh3F87Jn=&t>H?(ee4uL>SGZxQ@3W@i(#mGdhB5Xir+3qaaim+Z9o+xHB~SbjadpD*+nb4%pL_1LUmI3>%zPyN z(}?fKej;aLg_CN0x_)$v7}&$V0}S3P=xbC!`A-H{no;Ynz3oQ#+5MZ3$i!aU8GmwD z?{PbE9L)OaE)xr-Zi?!XotSMcB(vt(Npjudf~ezU)}gU|d3)c;{s~?i{;3Av?M*Z{ z8Wd9Y6YL8)I}v-G+w(8U9%_2uo*DjFE-vi>qBnM%*fly5RSpU4eA-n&l>NGMNQgQf zW$D5I(Y}kkkwRyd8NY362<`F~BDmBLIzGQwpTN+~|22qPK1gr8IMeqpaoOHNB3$+j z-(B>uIDaOH9;og~H){0Y^npay9^G3>T1v*kr&1&O>`NR_1uk3rRuad4L-2lvpby7@ntUsX<2ih9S*Ke` zoLK)S-a%5rGhp3Iu!QU3SJ^u6Uc;6rQCvEKwxVn^)^0v zS$`#E`AhSHC|nef$2FM!k@aJn7ZhV9ib?<~+Lt)65m5{h6ye#i4HU06Ftc}wKU9fF zBYVx(+C4?|w^*gi&r=6q^^;p-42O`0K<#dJCYJUIXGg0gWwikz-|&Y#g6 zL2~Jpn|K%LaK*nhGPAGf7*v;3<-@eUxFPRzHspbgmTigbnYz>(^u`v@XG>*i6ff;~ zuZJgT`VkS4mT-#hzJi>0JCv0sbeW`4Ud+^ho zmh@bJb_$}WFPcp=!;52POkHHo!SOG|@p3u{)kP-@(r$obrw|EWxb&SB4g8>!rhjt! zPIpSX@U)G15C8cO=Yl4k|dE(b&wA=?AKet)Y$W9tm3|I=*_WyKgUG8@mXc z8iLf;Q109ixQq%i2DZC)1osZW{E^!{@5+30{51kKG-VGz912em<>Zqs$X0ZhyCB=ebqiJbYng zQ464j7j|nM+obx|@gYm&ItZ-@WLw^C)_G%RI^#B=ewu}%x^J)fXMJ}PvVpykkJAK_ zjI6K$Z;=fqB5Od&UZC?F;tY3&qsls`yTjW`I_KlRF08m9`UT=FL_4K7mFT>dy(Lc` z11WupfzUagbk5DyzloWVU**-MV_i%)fc5OPDrZMib)Xu%n=8&69I>9o0)YUflK${IzFq?F@o`R3dWhlVbI7WTz0p^D{nb0 z?eMC4ly0DomvH8R+IJ^~ly#6oD^SBa(c6|%Ra+|7ZB(^h?BFhG&Eu3DNvoCN5je*C zzt9axqKJo@ur405a_&KnmjVgPgb(t>S0O#3B)=30JcuIJ<7k7hWY|Y+G^Llc0acDE zh9}ZZKsM`7m3<&kubY3i3?>LHi#`Q?gHw75P7!#wQN=onCkaFXeXB1POQJTAIM=o> zm(tQo6-6NKN9zJ{Y{z45GV-|0gyJpo@LfP&ZeQ)Y;y}<|`mW9Yq^w_VdI-MgknyXl`cj(*dZmjj_$?W^kNctgwq}cunI817H9yydX8em@{zJ-nA5 z^7_!$Ucy<4ubCN{PtPDJf?_LkDO`s4!q&a@PTu={$LlAAZa4?@CA<)R3oisqnlaa` z^V+KPGF(qDtMo+i`RN(&tZ0a9ErGL7ar)cTeM9|PP;VtHt^e&zY{388>`QO`FAxZs zr`wl0NIK@Rz0Ce&-Tf*80Z)CY3{(~2Xy-q`9bnur&Kzk80lAW{#m~W z;?VM8E@#1Q4&^O}rR_`oA2sVejM!1aS@Bt~>`NRRuYMSDraqNU5)~!-93y{zji?0U z&+vfgTB3rvH&iJi(0i8C%W_1&S0Vbh^iEqziUg7XRf@!z?oE=gP$8O!KL#wI%!#IZ z;dg;Da7lW>toKUZ&Jsm6x|onUMvO4`ujEB`gyJc-yYqK?uhkO$M`=OZ->JP6# zkw4V2pX7ECQRVD8`+oMdTv>l$eh<0yw@eNv43C5d%IrA>$p3@+dhCR%qZ|m z$uH?f=w!(&sr($`-~T#7%N7d`jqBXT6C=fw0C1RnT-6sTo(zs(wj~;u94v84LU_j` z^!CqmBXm~@XPyc9MNqD>gkoz25nDY_=^|0#Idemnk+~{{s00ZrzGZ#&B6K;9=m||k zN#}8|apSq;h}I=3bRu*&2@7ty(SBqbJDnr+;CO6ooSUGkrl^zw}51-}*{&}H-K)9Tu%3ypLN`B)TdVwZT`g2@mA+IoT7 z+C^uex@0MD*}9`G$9=|Jqz5h?P_kEFLbk<^iXgk zd-&KEQI?ci=vil{^VaO~#=(u~Q8&xYtL1bN?x%%KN-fgUETN~bNTv(#n|X{uoRMNE zjpl9rB`Qj4TLx(?*V7C-4P@Tjqn^WZf`%q&(k&dC?y3%ikrQ1fi1tH<{46txND{+eIKe!{8Qx>zq3yEUrih~M8`n>?#4iUvfx~F^- ziH$0$(#Y1@21%mw&SEzRbe1c08eMo02?&0u|3sK~4%#NWS)Zgw#y1Ojz5e3y(@#9` zu9p+NqRL?Urxugb%a58BYWo7y4iu z{d$`*YsaJx$sM{UrgUuIu~WxRw2bf2zI{Ssy!g-&%AS%fVvn*+NMSd6bW0G{r3DGO z_}V4g&-jSd+BE9KKds^xqewQeTYTrPJ-T-9IWQr;d!HU1Xh+_4e?G|V(Ytq8Y9j2C zdN%WUl>S7-(CcM(fgqTfRY7n3x|BLZ@WG=H_b6HQuU}yNy8mDR#d_W_E%?AyXZ(7R zS~-&ex4aRk?i0D*1F{5hzxht4pyOr>OqhXWdwIl_=g-MOT%> zBvF-Ew7jH$BkY3A*s8j!yo)oIq!N_^LhCvR2oxlP*8EI%NofWBUXE=QUZIywUDai5 zxWt&2je*SazjPU^&KXnx3AC<_S%~7P&AK+0DKVyHV<7W`KA8~`87&**WZu-Zh#Fiz z^(!`YZ44A^Y|*7ylT%c`Hd5EdDiOs8#_Fnaq$H}Aje*RV@w%$4#Tiq-QBl{%nh?eJ zD*L+s-?v8TR!&i!EW$Vn`DFx3h9_MnTq#*lq95LuYO3bkytw} z4i7HGHc$-f?W>nqkJhB$X^e(I-FuxRcD9I zZRL|e$gyAIn9&z#Jx8>3U>hR|sTv9+Ul*`}KJs`_T)AAAySkh^byR`ph~0Vj=Te^I&BWiul znDozV?jux7qFD3E0KHs`9*3fg?puI&lrp-rbCJ=F{QUu#KT=65#)xp;D-to(%JCgW zy;fH6R`|^8(OYb#4YhK;jUPP~2VM z411tk*m{0AebN3XNI{r5alheX+O$j_b_CYy4o>p_7*55v!l8L9! zmg&ZpEU8mzWmh0GWQ}fYX}~*G8@ z|JaDj*GeUyZgvHVQ}rn}KT0}!^9QjDH0V`nn>CT^mKipj9oZS+A`5`;O1BdH8)PyNZh1{ zam`#+X-2q(wcuu}KX1%^fAajjoTlfaFz+MDHOa_6#o)_1Rjjnc~% z>$5P1Yh;jVy*`y`5*5Yz)@Ed`W~nMFd-SPHm#8Ruq8s1K4pLKTpR6mE89H)FW% zspQp&_S>FzEyN8A_6*s(TanOKhptAw+nz|1d1OQ+5x)VZC{O#TVXYgI{ts90BS`=N literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/smb/smb2-read-response-non-zero-reserved1.test b/testing/btest/scripts/base/protocols/smb/smb2-read-response-non-zero-reserved1.test new file mode 100644 index 0000000000..6d2858a8c8 --- /dev/null +++ b/testing/btest/scripts/base/protocols/smb/smb2-read-response-non-zero-reserved1.test @@ -0,0 +1,9 @@ +# @TEST-DOC: Regression test for #4730, ReadResponse not parsed properly. +# +# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb_v2_only_non_zero_reserved1.pcap %INPUT +# @TEST-EXEC: btest-diff files.log +# @TEST-EXEC: test ! -f analyzer.log +# @TEST-EXEC: test ! -f weird.log + +@load base/protocols/smb +