Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

In SMB, don't attach the gssapi analyzer until a message is seen.

Browse source
This commit is contained in:
Seth Hall 2016-04-21 11:37:16 -04:00
parent b96fe860ea
commit bcdba4cc5d
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/analyzer/protocol/smb/smb-gssapi.pac
View file

@ -5,7 +5,7 @@ refine connection SMB_Conn += {
%}
%init{
gssapi = analyzer_mgr->InstantiateAnalyzer("GSSAPI", bro_analyzer->Conn());
gssapi = 0;
%}
%cleanup{
@ -15,6 +15,9 @@ refine connection SMB_Conn += {
function forward_gssapi(data: bytestring, is_orig: bool): bool
%{
if ( ! gssapi )
gssapi = analyzer_mgr->InstantiateAnalyzer("GSSAPI", bro_analyzer()->Conn());
if ( gssapi )
gssapi->DeliverStream(${data}.length(), ${data}.begin(), is_orig);