From 89675fc7de61b438fe8123e104f4dbcc41493f50 Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Mon, 23 Jan 2023 12:58:00 -0700
Subject: [PATCH] Add test for new handling of unknown RDP keyboards

---
 .../rdp.log                                      |  11 +++++++++++
 .../btest/Traces/rdp/rdp-unknown-keyboard.pcap   | Bin 0 -> 1432 bytes
 .../base/protocols/rdp/rdp-unknown-keyboard.zeek |   8 ++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log
 create mode 100644 testing/btest/Traces/rdp/rdp-unknown-keyboard.pcap
 create mode 100644 testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek

diff --git a/testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log b/testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log
new file mode 100644
index 0000000000..37dd9625da
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	rdp
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	cookie	result	security_protocol	client_channels	keyboard_layout	client_build	client_name	client_dig_product_id	desktop_width	desktop_height	requested_color_depth	cert_type	cert_count	cert_permanent	encryption_level	encryption_method
+#types	time	string	addr	port	addr	port	string	string	string	vector[string]	string	string	string	string	count	count	string	string	count	bool	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.1.1	54990	192.168.1.2	3389	JOHN-PC  	-	RDP	rdpdr,rdpsnd,cliprdr,drdynvc	Thai (Best Guess for 263198)	RDP 8.1	JOHN-PC-LAPTOP	3c571ed0-3415-474b-ae94-74e151b	1920	1080	16bit	-	0	-	-	-
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Traces/rdp/rdp-unknown-keyboard.pcap b/testing/btest/Traces/rdp/rdp-unknown-keyboard.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..d2497f26a147789ab9166edc6b52ef0ccceb2cc0
GIT binary patch
literal 1432
zcmbu9O-NKx6vzMPzBekVHCTS6Q9~4{FplO(W(k&kjAr9lQZ8ztGZRXsHd8_n^mG{!
zErPbXk&0T3MZ4^Yv`EN;%0LQQwQ%L4O=3>x+!;TZ2@8A7z3<#}?){y6{`bE5I5{?=
zU}E`+#{uHOi8o)`AI$<s*p`OC**l9)6ux%mH)P=$;H{WyfR*7JwI333Q!~@K_1Q7=
zmrS;l3!fVRWjY4PFtUhDCB&a=iJFz*CWxgmUYT+CmC%HmTR$`XHGEq!b;-(Gn7==)
ziO-n`AvQ7b#Z|}Z9@B}>H1XxX5}SqicD<@Sdvw(;vOl5zt!h6L_hlG3#HvV3)3Ma!
z*2LBn;u2SG1e}C-=Vh5Z!n#moAk4P3G}bv!g=X#gBddteH3Arbr~I2NM`K^#rJit|
z>q_)mw7WCfUEkd5^Sc9$E?4d*LYAH*Nyj;96OW`NuE3gOJ6JX<Nl#6R9FjPBY({p>
z;SLlnOvF4o>DJBffjlo%65Ph%*(bCPxZJP7B^v-gC|*~llUgRdTY)DJF(LWJWRhy;
zIO)ncr{2ZV@-w=cvXp8Hv`o&0iBBC`Z|+Vr>%%?55B?CPrJgf=_jCyB_(hR>wE%~k
z?@U2}3z#n!$!T28TerePG-mSWLj1%lw=3GMNGXCMO7<!qXP1Q7v+~mul<AVt4kdHc
zVxfMgEHsCx4GwI(2^#eA;W|M!j$RLT4%U%92a{b^X01t6#^ar)32QIVj8^#IhZ_Mj
za^Hf(Y_+pDphZ~zKgwB_<UigtB@%+SwFOTzs}V#E_M?iwpb#oKcQw2`s$t8^elNP%
z>g4DFw%ytj*6}Ki0GXPV-kEj|@{?}Gc1hAU>{?a;h=lq>5$&@qwxhivJ+On9d-@|f
QGHiz;p&PveK@M2<Z~1LD2><{9

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek b/testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek
new file mode 100644
index 0000000000..cdcc267e06
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek
@@ -0,0 +1,8 @@
+# Tests the keyboard_layout code in the RDP protocol for handling
+# keyboards script-layer doesn't know about, and the fallback
+# to looking for best guesses.
+
+# @TEST-EXEC: zeek -C -b -r $TRACES/rdp/rdp-unknown-keyboard.pcap %INPUT
+# @TEST-EXEC: btest-diff rdp.log
+
+@load base/protocols/rdp
\ No newline at end of file