Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Redo DCE/RPC code.

Browse source
This commit is contained in:
Vlad Grigorescu 2014-10-09 21:06:38 -04:00
parent c4eb7e2377
commit 9a73033b19
16 changed files with 1036 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/smb/main.bro
View file

@ -128,6 +128,8 @@ export {
tid_map : table[count] of TreeInfo &optional;
## User map to retrieve user name based on the user ID.
uid_map : table[count] of string &optional;
## Pipe map to retrieve UUID based on the file ID of a pipe.
pipe_map : table[count] of string &optional;
};
redef record connection += {
@ -139,6 +141,7 @@ export {
## Some commands shouldn't be logged by the smb1_message event
const deferred_logging_cmds: set[string] = {
"NEGOTIATE",
"READ_ANDX",
"SESSION_SETUP_ANDX",
"TREE_CONNECT_ANDX",
};
@ -152,10 +155,13 @@ export {
redef record FileInfo += {
## ID referencing this file.
fid : count &optional;
fid : count &optional;
## Maintain a reference to the file record.
f : fa_file &optional;
f : fa_file &optional;
## UUID referencing this file if DCE/RPC
uuid: string &optional;
};
const ports = { 139/tcp, 445/tcp };