Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'rdp_client_cluster_data' of https://github.com/neslog/zeek

Browse source 
* 'rdp_client_cluster_data' of https://github.com/neslog/zeek:
  Fixing types.
  Correcting types.
  Removing misc data from Client Cluster data trying to assign values.
  Adding options field to RDP::ClientChannelDef Adding Client Cluster Data

Adjustments:

- Reformatting
- Added comments
- Changed the REDIRECTED_SESSIONID_FIELD_VALID field to a bool
This commit is contained in:
Jon Siwek 2019-06-20 20:36:08 -07:00
commit d72f5458f1
11 changed files with 123 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/analyzer/protocol/rdp/rdp-protocol.pac
View file

@ -54,7 +54,7 @@ type Data_Block = record {
0xc001 -> client_core: Client_Core_Data;
0xc002 -> client_security: Client_Security_Data;
0xc003 -> client_network: Client_Network_Data;
#0xc004 -> client_cluster: Client_Cluster_Data;
0xc004 -> client_cluster: Client_Cluster_Data;
#0xc005 -> client_monitor: Client_Monitor_Data;
#0xc006 -> client_msgchannel: Client_MsgChannel_Data;
#0xc008 -> client_monitor_ex: Client_MonitorExtended_Data;
@ -230,6 +230,16 @@ type Client_Network_Data = record {
channel_def_array: Client_Channel_Def[channel_count];
} &byteorder=littleendian;
type Client_Cluster_Data = record {
flags: uint32;
redir_session_id: uint32;
} &let {
REDIRECTION_SUPPORTED: bool = redir_session_id & 0x00000001;
SERVER_SESSION_REDIRECTION_VERSION_MASK: uint8 = (redir_session_id & 0x0000003C);
REDIRECTED_SESSIONID_FIELD_VALID: bool = (redir_session_id & 0x00000002);
REDIRECTED_SMARTCARD: bool = redir_session_id & 0x00000040;
} &byteorder=littleendian;
type Client_Channel_Def = record {
name: bytestring &length=8;
options: uint32;