Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

change: RDPUDP_CORRELATION_ID_PAYLOAD definition

Browse source
This commit is contained in:
Anthony Kasza 2020-04-03 11:37:13 -06:00
parent 32a52590d0
commit bf97b41856
2 changed files with 6 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/analyzer/protocol/rdp/rdpeudp-analyzer.pac
View file

@ -25,9 +25,9 @@ refine connection RDPEUDP_Conn += {
function is_rdpeudp2(): bool function is_rdpeudp2(): bool
%{ %{
printf("orig synex flags: %d\n", orig_synex_flags_); printf("orig synex flags: %#010x\n", orig_synex_flags_);
printf("resp synex flags: %d\n", resp_synex_flags_); printf("resp synex flags: %#010x\n", resp_synex_flags_);
printf("anded synex flags: %d\n", (orig_synex_flags_ & resp_synex_flags_)); printf("anded synex flags: %#010x\n", (orig_synex_flags_ & resp_synex_flags_));
return ((orig_synex_flags_ & resp_synex_flags_) >= RDPUDP_PROTOCOL_VERSION_3); return ((orig_synex_flags_ & resp_synex_flags_) >= RDPUDP_PROTOCOL_VERSION_3);
%} %}

8
src/analyzer/protocol/rdp/rdpeudp-protocol.pac
View file

@ -35,8 +35,8 @@ type RDPEUDP_SYN(pdu: RDPEUDP_PDU, is_orig: bool) = record {
false -> has_no_synex_payload: empty; false -> has_no_synex_payload: empty;
}; };
} &let { } &let {
# proc_rdpeudp_syn: bool = $context.connection.proc_rdpeudp_syn(is_orig, fec_header.uFlags, fec_header.snSourceAck); proc_rdpeudp_syn: bool = $context.connection.proc_rdpeudp_syn(is_orig, fec_header.uFlags,
proc_rdpeudp_syn: bool = $context.connection.proc_rdpeudp_syn(is_orig, fec_header.uFlags, fec_header.snSourceAck, has_synex_payload.uUdpVer); fec_header.snSourceAck, has_synex_payload.uUdpVer);
}; };
# The tech specs refer to this as RDPUDP_SYNEX_PAYLOAD and RDPUDP_SYNDATAEX_PAYLOAD interchangably # The tech specs refer to this as RDPUDP_SYNEX_PAYLOAD and RDPUDP_SYNDATAEX_PAYLOAD interchangably
@ -56,7 +56,7 @@ enum RDPUDP_VERSION_INFO_FLAG {
}; };
type RDPUDP_CORRELATION_ID_PAYLOAD = record { type RDPUDP_CORRELATION_ID_PAYLOAD = record {
uCorrelationId: uint16; uCorrelationId: uint8[16];
uReserved: uint16; uReserved: uint16;
}; };
@ -78,9 +78,7 @@ type RDPEUDP_SYNACK(pdu: RDPEUDP_PDU, is_orig: bool) = record {
false -> has_no_synex_payload: empty; false -> has_no_synex_payload: empty;
}; };
} &let { } &let {
# proc_rdpeudp_synack: bool = $context.connection.proc_rdpeudp_synack(is_orig, fec_header.uFlags);
proc_rdpeudp_synack: bool = $context.connection.proc_rdpeudp_synack(is_orig, fec_header.uFlags, has_synex_payload.uUdpVer); proc_rdpeudp_synack: bool = $context.connection.proc_rdpeudp_synack(is_orig, fec_header.uFlags, has_synex_payload.uUdpVer);
} &let {
}; };
enum RDPUDP_FLAG { enum RDPUDP_FLAG {