diff --git a/CHANGES b/CHANGES index b45471b531..da1c3bb9e4 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,10 @@ +2.6-beta2-55 | 2018-10-30 09:59:44 -0500 + + * Add a test with an encrypted MySQL connection (Vlad Grigorescu) + + * Fix parsing of MySQL NUL Strings (Vlad Grigorescu) + 2.6-beta2-51 | 2018-10-26 10:41:42 -0500 * Add missing record field comment (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 6bab04ca6f..c86c33eb80 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-beta2-51 +2.6-beta2-55 diff --git a/src/analyzer/protocol/mysql/mysql-analyzer.pac b/src/analyzer/protocol/mysql/mysql-analyzer.pac index 24401c110e..a6981e9e87 100644 --- a/src/analyzer/protocol/mysql/mysql-analyzer.pac +++ b/src/analyzer/protocol/mysql/mysql-analyzer.pac @@ -7,12 +7,12 @@ refine flow MySQL_Flow += { { if ( ${msg.version} == 10 ) BifEvent::generate_mysql_server_version(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - bytestring_to_val(${msg.handshake10.server_version})); + connection()->bro_analyzer()->Conn(), + new StringVal(c_str(${msg.handshake10.server_version}))); if ( ${msg.version} == 9 ) BifEvent::generate_mysql_server_version(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - bytestring_to_val(${msg.handshake9.server_version})); + connection()->bro_analyzer()->Conn(), + new StringVal(c_str(${msg.handshake9.server_version}))); } return true; %} @@ -26,12 +26,12 @@ refine flow MySQL_Flow += { { if ( ${msg.version} == 10 ) BifEvent::generate_mysql_handshake(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - bytestring_to_val(${msg.v10_response.username})); + connection()->bro_analyzer()->Conn(), + new StringVal(c_str(${msg.v10_response.username}))); if ( ${msg.version} == 9 ) BifEvent::generate_mysql_handshake(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - bytestring_to_val(${msg.v9_response.username})); + connection()->bro_analyzer()->Conn(), + new StringVal(c_str(${msg.v9_response.username}))); } return true; %} @@ -40,9 +40,9 @@ refine flow MySQL_Flow += { %{ if ( mysql_command_request ) BifEvent::generate_mysql_command_request(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - ${msg.command}, - bytestring_to_val(${msg.arg})); + connection()->bro_analyzer()->Conn(), + ${msg.command}, + bytestring_to_val(${msg.arg})); return true; %} @@ -50,9 +50,9 @@ refine flow MySQL_Flow += { %{ if ( mysql_error ) BifEvent::generate_mysql_error(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - ${msg.code}, - bytestring_to_val(${msg.msg})); + connection()->bro_analyzer()->Conn(), + ${msg.code}, + bytestring_to_val(${msg.msg})); return true; %} @@ -60,8 +60,8 @@ refine flow MySQL_Flow += { %{ if ( mysql_ok ) BifEvent::generate_mysql_ok(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - ${msg.rows}); + connection()->bro_analyzer()->Conn(), + ${msg.rows}); return true; %} diff --git a/src/analyzer/protocol/mysql/mysql-protocol.pac b/src/analyzer/protocol/mysql/mysql-protocol.pac index e352de0d37..b61cd0c4bc 100644 --- a/src/analyzer/protocol/mysql/mysql-protocol.pac +++ b/src/analyzer/protocol/mysql/mysql-protocol.pac @@ -151,7 +151,7 @@ enum Expected { EXPECT_AUTH_SWITCH, }; -type NUL_String = RE/[^\0]*/; +type NUL_String = RE/[^\0]*\0/; # MySQL PDU diff --git a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted/mysql.log b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted/mysql.log new file mode 100644 index 0000000000..e69de29bb2 diff --git a/testing/btest/Traces/mysql/encrypted.trace b/testing/btest/Traces/mysql/encrypted.trace new file mode 100644 index 0000000000..dcf3689394 Binary files /dev/null and b/testing/btest/Traces/mysql/encrypted.trace differ diff --git a/testing/btest/scripts/base/protocols/mysql/encrypted.test b/testing/btest/scripts/base/protocols/mysql/encrypted.test new file mode 100644 index 0000000000..e41c93186f --- /dev/null +++ b/testing/btest/scripts/base/protocols/mysql/encrypted.test @@ -0,0 +1,8 @@ +# This tests how Bro deals with encrypted connections. Right now, it doesn't log them as it +# can't parse much of value. We're testing for an empty mysql.log file. + +# @TEST-EXEC: touch mysql.log +# @TEST-EXEC: bro -b -r $TRACES/mysql/encrypted.trace %INPUT +# @TEST-EXEC: btest-diff mysql.log + +@load base/protocols/mysql \ No newline at end of file