Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/jsiwek/gh-646-conn-removal'

Browse source 
Clarified doc strings a bit.

* origin/topic/jsiwek/gh-646-conn-removal:
  GH-646: add new "successful_connection_remove" event
This commit is contained in:
Robin Sommer 2019-11-18 11:44:22 +00:00
commit a00f139f1c
51 changed files with 596 additions and 379 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/init-bare.zeek
View file

@ -419,6 +419,11 @@ type connection: record {
## The inner VLAN, if applicable for this connection.
inner_vlan: int &optional;
## Flag that will be true if :zeek:see:`connection_successful` has
## already been generated for the connection. See the documentation of
## that event for a definition of what makes a connection "succesful".
successful: bool;
};
## Default amount of time a file can be inactive before the file analysis
@ -2579,7 +2584,7 @@ export {
negotiate_lm_key : bool;
## If set, requests connectionless authentication
negotiate_datagram : bool;
## If set, requests session key negotiation for message
## If set, requests session key negotiation for message
## confidentiality
negotiate_seal : bool;
## If set, requests session key negotiation for message
@ -2767,7 +2772,7 @@ export {
## The server supports compressed data transfer. Requires bulk_transfer.
## Note: No known implementations support this
compressed_data : bool;
## The server supports extended security exchanges
## The server supports extended security exchanges
extended_security : bool;
};
@ -2860,7 +2865,7 @@ export {
};
type SMB1::NegotiateResponse: record {
## If the server does not understand any of the dialect strings, or if
## If the server does not understand any of the dialect strings, or if
## PC NETWORK PROGRAM 1.0 is the chosen dialect.
core : SMB1::NegotiateResponseCore &optional;
## If the chosen dialect is greater than core up to and including
@ -2911,7 +2916,7 @@ export {
## If challenge/response auth is not being used, this is the password.
## Otherwise, it's the response to the server's challenge.
## Note: Only set for pre NT LM 0.12
account_password : string &optional;
account_password : string &optional;
## Client's primary domain, if known
## Note: not set for NT LM 0.12 with extended security
primary_domain : string &optional;
@ -2929,7 +2934,7 @@ export {
## Note: only set for NT LM 0.12
capabilities : SMB1::SessionSetupAndXCapabilities &optional;
};
type SMB1::SessionSetupAndXResponse: record {
## Count of parameter words (should be 3 for pre NT LM 0.12 and 4 for NT LM 0.12)
word_count : count;
@ -3994,7 +3999,7 @@ type bt_tracker_headers: table[string] of string;
## for a range of modbus coils.
type ModbusCoils: vector of bool;
## A vector of count values that represent 16bit modbus
## A vector of count values that represent 16bit modbus
## register values.
type ModbusRegisters: vector of count;