mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
Fixing SMB tests again.
This commit is contained in:
parent
7936cdd958
commit
cfe3bddd75
12 changed files with 27 additions and 85 deletions
|
@ -1,4 +1,2 @@
|
|||
@load ./consts
|
||||
@load ./main
|
||||
|
||||
@load ./endpoint-atsvc
|
|
@ -1,52 +0,0 @@
|
|||
module DCE_RPC;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += {
|
||||
ATSVC_LOG,
|
||||
};
|
||||
|
||||
type ATSvcInfo: record {
|
||||
ts : time &log; ##< Time of the request
|
||||
uid : string &log; ##< UID of the connection
|
||||
id : conn_id &log; ##< Connection info
|
||||
command : string &log; ##< Command (add, enum, delete, etc.)
|
||||
arg : string &log; ##< Argument
|
||||
server : string &log; ##< Server the command was issued to
|
||||
result : string &log &optional; ##< Result of the command
|
||||
};
|
||||
}
|
||||
|
||||
redef record DCE_RPC::State += {
|
||||
endpoint_atsvc: ATSvcInfo &optional;
|
||||
};
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(ATSVC_LOG, [$columns=ATSvcInfo, $path="dce_rpc_atsvc"]);
|
||||
}
|
||||
|
||||
event atsvc_job_add(c: connection, server: string, job: string) &priority=5
|
||||
{
|
||||
local info = ATSvcInfo($ts=network_time(),
|
||||
$uid = c$uid,
|
||||
$id = c$id,
|
||||
$command = "Add job",
|
||||
$arg = job,
|
||||
$server = server);
|
||||
c$dce_rpc_state$endpoint_atsvc = info;
|
||||
}
|
||||
|
||||
event atsvc_job_id(c: connection, id: count, status: count) &priority=5
|
||||
{
|
||||
if ( c$dce_rpc_state?$endpoint_atsvc )
|
||||
c$dce_rpc_state$endpoint_atsvc$result = (status==0) ? "success" : "failed";
|
||||
}
|
||||
|
||||
event atsvc_job_id(c: connection, id: count, status: count) &priority=-5
|
||||
{
|
||||
if ( c$dce_rpc_state?$endpoint_atsvc )
|
||||
{
|
||||
Log::write(ATSVC_LOG, c$dce_rpc_state$endpoint_atsvc);
|
||||
delete c$dce_rpc_state$endpoint_atsvc;
|
||||
}
|
||||
}
|
|
@ -1,4 +1,5 @@
|
|||
# DOS error codes.
|
||||
@load ./consts
|
||||
|
||||
module SMB;
|
||||
|
||||
|
|
|
@ -1,4 +1,5 @@
|
|||
# NT status codes.
|
||||
@load ./consts
|
||||
|
||||
module SMB;
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue