Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix a crash when a user disables DCE_RPC and enabled SMB.

Browse source 
I wasn't accounting for analyzers being disabled and not actually
instantiating when requested.  This includes a test which
verifies there is no crash or problem when a user disables DCE_RPC.
This commit is contained in:
Seth Hall 2016-08-28 21:28:57 -04:00
parent ec0ffc5452
commit 8015e35747
2 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test Normal file
View file

@ -0,0 +1,12 @@
# @TEST-EXEC: bro -C -r $TRACES/smb/dssetup_DsRoleGetPrimaryDomainInformation_standalone_workstation.cap %INPUT
# @TEST-EXEC: [ ! -f dce_rpc.log ]
@load policy/protocols/smb
# The DCE_RPC analyzer is a little weird since it's instantiated
# by the SMB analyzer directly in some cases. Care needs to be
# taken to handle a disabled analyzer correctly.
event bro_init()
{
Analyzer::disable_analyzer(Analyzer::ANALYZER_DCE_RPC);
}