Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixes for MySQL and SMB protocol parsers

Browse source 
* MySQL: the parser for this was generally broken (not following
  the specification well) and needed many changes.  One addition is a
  new "mysql_result_row" event that provides access to the results of
  queries.

* SMB: the spec seems to explitly call out the omission of the
  PrimaryDomain field on SMB_COM_SESSION_SETUP_ANDX responses (and I
  don't see that field in pcaps either), so this may have just been a
  typo that used to work fine in the past only due to faulty array
  parsing behavior in binpac.
This commit is contained in:
Jon Siwek 2018-05-17 10:23:23 -05:00
parent 9c1e20394b
commit 954e7980cf
9 changed files with 349 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
View file

@ -99,7 +99,7 @@ refine connection SMB_Conn += {
response->Assign(1, new Val(${val.ntlm.is_guest}, TYPE_BOOL));
response->Assign(2, smb_string2stringval(${val.ntlm.native_os}));
response->Assign(3, smb_string2stringval(${val.ntlm.native_lanman}));
response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain}));
//response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain}));
//response->Assign(5, bytestring_to_val(${val.ntlm.security_blob}));
break;
default: // Error!
@ -242,7 +242,6 @@ type SMB1_session_setup_andx_response_ntlm(header: SMB_Header, offset: uint16) =
# offset + 1 due to word_count in the parent type
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
extra_byte_parameters : bytestring &transient &length=(andx.offset == 0 || andx.offset >= (offset+offsetof(extra_byte_parameters))+2) ? 0 : (andx.offset-(offset+offsetof(extra_byte_parameters)));