Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 08:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixes for MySQL and SMB protocol parsers

Browse source 
* MySQL: the parser for this was generally broken (not following
  the specification well) and needed many changes.  One addition is a
  new "mysql_result_row" event that provides access to the results of
  queries.

* SMB: the spec seems to explitly call out the omission of the
  PrimaryDomain field on SMB_COM_SESSION_SETUP_ANDX responses (and I
  don't see that field in pcaps either), so this may have just been a
  typo that used to work fine in the past only due to faulty array
  parsing behavior in binpac.
This commit is contained in:
Jon Siwek 2018-05-17 10:23:23 -05:00
parent 9c1e20394b
commit 954e7980cf
9 changed files with 349 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

25
testing/btest/scripts/base/protocols/mysql/wireshark.test
View file

@ -1,6 +1,27 @@
# This tests a PCAP with a few MySQL commands from the Wireshark samples.
# @TEST-EXEC: bro -b -r $TRACES/mysql/mysql.trace %INPUT
# @TEST-EXEC: bro -b -r $TRACES/mysql/mysql.trace %INPUT >out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff mysql.log
@load base/protocols/mysql
@load base/protocols/mysql
event mysql_ok(c: connection, affected_rows: count)
{
print "mysql ok", affected_rows;
}
event mysql_result_row(c: connection, row: string_vec)
{
print "mysql result row", row;
}
event mysql_error(c: connection, code: count, msg: string)
{
print "mysql error", code, msg;
}
event mysql_command_request(c: connection, command: count, arg: string)
{
print "mysql request", command, arg;
}