Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 08:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixes for MySQL and SMB protocol parsers

Browse source 
* MySQL: the parser for this was generally broken (not following
  the specification well) and needed many changes.  One addition is a
  new "mysql_result_row" event that provides access to the results of
  queries.

* SMB: the spec seems to explitly call out the omission of the
  PrimaryDomain field on SMB_COM_SESSION_SETUP_ANDX responses (and I
  don't see that field in pcaps either), so this may have just been a
  typo that used to work fine in the past only due to faulty array
  parsing behavior in binpac.
This commit is contained in:
Jon Siwek 2018-05-17 10:23:23 -05:00
parent 9c1e20394b
commit 954e7980cf
9 changed files with 349 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

42
testing/btest/Baseline/scripts.base.protocols.mysql.wireshark/out Normal file
View file

@ -0,0 +1,42 @@
mysql ok, 0
mysql request, 3, select @@version_comment limit 1
mysql ok, 0
mysql result row, [Gentoo Linux mysql-5.0.54]
mysql request, 3, SELECT DATABASE()
mysql ok, 0
mysql result row, []
mysql request, 2, test
mysql ok, 0
mysql request, 3, show databases
mysql ok, 0
mysql result row, [information_schema]
mysql result row, [test]
mysql request, 3, show tables
mysql ok, 0
mysql result row, [agent]
mysql request, 4, agent\x00
mysql request, 3, create table foo (id BIGINT( 10 ) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY, animal VARCHAR(64) NOT NULL, name VARCHAR(64) NULL DEFAULT NULL) ENGINE = MYISAM
mysql ok, 0
mysql request, 3, insert into foo (animal, name) values ("dog", "Goofy")
mysql ok, 1
mysql request, 3, insert into foo (animal, name) values ("cat", "Garfield")
mysql ok, 1
mysql request, 3, select * from foo
mysql ok, 0
mysql result row, [1, dog, Goofy]
mysql result row, [2, cat, Garfield]
mysql request, 3, delete from foo where name like '%oo%'
mysql ok, 1
mysql request, 3, delete from foo where id = 1
mysql ok, 0
mysql request, 3, select count(*) from foo
mysql ok, 0
mysql result row, [1]
mysql request, 3, select * from foo
mysql ok, 0
mysql result row, [2, cat, Garfield]
mysql request, 3, delete from foo
mysql ok, 1
mysql request, 3, drop table foo
mysql ok, 0
mysql request, 1,