Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'rdp_client_cluster_data' of https://github.com/neslog/zeek

Browse source 
* 'rdp_client_cluster_data' of https://github.com/neslog/zeek:
  Fixing types.
  Correcting types.
  Removing misc data from Client Cluster data trying to assign values.
  Adding options field to RDP::ClientChannelDef Adding Client Cluster Data

Adjustments:

- Reformatting
- Added comments
- Changed the REDIRECTED_SESSIONID_FIELD_VALID field to a bool
This commit is contained in:
Jon Siwek 2019-06-20 20:36:08 -07:00
commit d72f5458f1
11 changed files with 123 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

22
testing/btest/scripts/base/protocols/rdp/rdp-client-cluster-data.zeek Normal file
View file

@ -0,0 +1,22 @@
# @TEST-EXEC: zeek -r $TRACES/rdp/rdp-proprietary-encryption.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
@load base/protocols/rdp
event rdp_client_cluster_data(c: connection, data: RDP::ClientClusterData)
{
print "RDP Client Cluster Data";
print fmt("Flags: %08x",data$flags);
print fmt("RedirSessionId: %08x",data$redir_session_id);
print fmt("Redirection Supported: %08x",data$redir_supported);
print fmt("ServerSessionRedirectionVersionMask: %08x",data$svr_session_redir_version_mask);
print fmt("RedirectionSessionIDFieldValid: %08x",data$redir_sessionid_field_valid);
print fmt("RedirectedSmartCard: %08x",data$redir_smartcard);
}
event rdp_client_network_data(c: connection, channels: RDP::ClientChannelList)
{
print "RDP Client Channel List Options";
for ( i in channels )
print fmt("%08x", channels[i]$options);
}