Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/seth/smb-auth-fixes'

Browse source 
* origin/topic/seth/smb-auth-fixes:
  Disable SMB2 error data parsing.
  Removed some files that aren't being used.
  Fix SMB tree connect handling.
  Fix a small issue where DCE_RPC commands were improperly being logged.
  SMB fixes and cleanup.
  Including a test for raw NTLM in SMB
  Updates for SMB auth handling from Martin van Hensbergen.

BIT-1721 #merged
This commit is contained in:
Johanna Amann 2016-11-02 09:47:20 -07:00
commit c92060a8ca
44 changed files with 327 additions and 308 deletions
Download patch file Download diff file Expand all files Collapse all files

14
testing/btest/scripts/base/protocols/smb/raw-ntlm.test Normal file
View file

@ -0,0 +1,14 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/raw_ntlm_in_smb.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/ntlm
@load policy/protocols/smb
# Just verify that the session key is grabbed correctly from NTLM
# carried raw over SMB.
event ntlm_authenticate(c: connection, request: NTLM::Authenticate)
{
if ( request?$session_key )
print request$session_key;
}