Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix for an issue with GSSAPI mech_token from Florent Monjalet

Browse source 
From Florent's patch:
Previously, the ASN1EncodingMeta was in the NTLM_SSP_Token; this broke the
NTLM decoding when used directly with DCE-RPC. NTLM now works on DCE-RPC
and should work properly on other layers in the future (e.g. HTTP
Authentication data).
This commit is contained in:
Seth Hall 2016-07-07 13:03:33 -04:00
parent 5c744fa0c9
commit c31c0ed2e2
3 changed files with 9 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/analyzer/protocol/gssapi/gssapi-analyzer.pac
View file

@ -36,12 +36,11 @@ refine connection GSSAPI_Conn += {
%}
}
refine typeattr GSSAPI_NEG_TOKEN_INIT_Arg_Data += &let {
fwd: bool = $context.connection.forward_ntlm(mech_token, true) &if(index==2);
refine typeattr GSSAPI_NEG_TOKEN_MECH_TOKEN += &let {
fwd: bool = $context.connection.forward_ntlm(mech_token, is_orig);
};
refine typeattr GSSAPI_NEG_TOKEN_RESP_Arg += &let {
proc: bool = $context.connection.proc_gssapi_neg_result(this) &if(seq_meta.index==0);
fwd: bool = $context.connection.forward_ntlm(response_token, false) &if(seq_meta.index==2);
};