Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SMB: Init lanman time and set TZ correctly before calling mktime

Browse source 
This makes a change to the record for smb1-negotiate-response as well.
Times and dates are two 2-byte sections, not three. Switch the parsing
to just use two uint16s, and pass those into the lanman time conversion
function.
This commit is contained in:
Tim Wojtulewicz 2025-09-05 15:39:17 -07:00
parent 3c16ee9667
commit 8efddf87d9
6 changed files with 55 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

19
testing/btest/scripts/base/protocols/smb/smb1-negotiate-lanman.zeek Normal file
View file

@ -0,0 +1,19 @@
# @TEST-DOC: Tests parsing of SMB1 Negotiate Request/Response LanMan messages. Primarily exists to test parsing of the timetstamps.
#
# @TEST-EXEC: zeek -r ${TRACES}/smb/cifs_negotiate_lanman.pcap %INPUT > out
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff out
event smb1_negotiate_request(c: connection, hdr: SMB1::Header, dialects: string_vec)
{
print "smb1_negotiate_request";
print hdr;
print dialects;
}
event smb1_negotiate_response(c: connection, hdr: SMB1::Header, response: SMB1::NegotiateResponse)
{
print "smb1_negotiate_response";
print hdr;
print response;
print fmt("Parsed Response Server Time: %DT", response$lanman$server_time);
}