Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixes for MySQL and SMB protocol parsers

Browse source 
* MySQL: the parser for this was generally broken (not following
  the specification well) and needed many changes.  One addition is a
  new "mysql_result_row" event that provides access to the results of
  queries.

* SMB: the spec seems to explitly call out the omission of the
  PrimaryDomain field on SMB_COM_SESSION_SETUP_ANDX responses (and I
  don't see that field in pcaps either), so this may have just been a
  typo that used to work fine in the past only due to faulty array
  parsing behavior in binpac.
This commit is contained in:
Jon Siwek 2018-05-17 10:23:23 -05:00
parent 9c1e20394b
commit 954e7980cf
9 changed files with 349 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/analyzer/protocol/mysql/mysql-analyzer.pac
View file

@ -67,10 +67,41 @@ refine flow MySQL_Flow += {
function proc_resultset(msg: Resultset): bool
%{
if ( mysql_ok )
BifEvent::generate_mysql_ok(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
${msg.rows}->size());
if ( connection()->get_results_seen() == 1 )
{
// This is a bit fake...
if ( mysql_ok )
BifEvent::generate_mysql_ok(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
0);
}
if ( ${msg.is_eof} )
return true;
if ( ! mysql_result_row )
return true;
auto vt = internal_type("string_vec")->AsVectorType();
auto vv = new VectorVal(vt);
auto& bstring = ${msg.row.first_field.val};
auto ptr = reinterpret_cast<const char*>(bstring.data());
vv->Assign(vv->Size(), new StringVal(bstring.length(), ptr));
auto& fields = *${msg.row.fields};
for ( auto& f : fields )
{
auto& bstring = f->val();
auto ptr = reinterpret_cast<const char*>(bstring.data());
vv->Assign(vv->Size(), new StringVal(bstring.length(), ptr));
}
BifEvent::generate_mysql_result_row(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
vv);
return true;
%}