Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

RDP: Instantiate SSL analyzer instead of PIA

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-03-24 11:05:33 -07:00
parent a9d3245e80
commit 943b8b0b42
2 changed files with 6 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/analyzer/protocol/rdp/RDP.cc
View file

@ -13,7 +13,7 @@ RDP_Analyzer::RDP_Analyzer(Connection* c) : analyzer::tcp::TCP_ApplicationAnalyz
interp = new binpac::RDP::RDP_Conn(this);
had_gap = false;
pia = nullptr;
ssl = nullptr;
}
RDP_Analyzer::~RDP_Analyzer()
@ -54,19 +54,15 @@ void RDP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
// 0x03-0x04 is CredSSP which is effectively SSL/TLS
if ( interp->encryption_method() > 0x00 )
{
if ( ! pia )
if ( ! ssl )
{
pia = new analyzer::pia::PIA_TCP(Conn());
if ( ! AddChildAnalyzer(pia) )
ssl = new analyzer::ssl::SSL_Analyzer(Conn());
if ( ! AddChildAnalyzer(ssl) )
{
reporter->AnalyzerError(this, "failed to add TCP child analyzer "
"to RDP analyzer: already exists");
return;
}
pia->FirstPacket(true, nullptr);
pia->FirstPacket(false, nullptr);
}
ForwardStream(len, data, orig);

3
src/analyzer/protocol/rdp/RDP.h
View file

@ -3,6 +3,7 @@
#include "zeek/analyzer/protocol/pia/PIA.h"
#include "zeek/analyzer/protocol/rdp/events.bif.h"
#include "zeek/analyzer/protocol/rdp/rdp_pac.h"
#include "zeek/analyzer/protocol/ssl/SSL.h"
#include "zeek/analyzer/protocol/tcp/TCP.h"
namespace zeek::analyzer::rdp
@ -30,7 +31,7 @@ protected:
binpac::RDP::RDP_Conn* interp;
bool had_gap;
analyzer::pia::PIA_TCP* pia;
analyzer::ssl::SSL_Analyzer* ssl;
};
} // namespace zeek::analyzer::rdp