From db7aba0835ef82e16cf56017a876f61ab8b4a72a Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@corelight.com>
Date: Wed, 10 Mar 2021 13:52:44 +0000
Subject: [PATCH] ts fields in SMB logs now default to network_time()

This avoids a problem identified by amanbansal2709 in pull
request #1288. I fixed it in a different way than that pull request
by making sure the ts field is always set so that this isssue doesn't
return in the future.
---
 scripts/base/protocols/smb/main.zeek      | 6 +++---
 scripts/base/protocols/smb/smb1-main.zeek | 8 ++++----
 scripts/base/protocols/smb/smb2-main.zeek | 8 ++++----
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/scripts/base/protocols/smb/main.zeek b/scripts/base/protocols/smb/main.zeek
index 974dae8920..cfccde16ac 100644
--- a/scripts/base/protocols/smb/main.zeek
+++ b/scripts/base/protocols/smb/main.zeek
@@ -48,7 +48,7 @@ export {
 	## This record is for the smb_files.log
 	type FileInfo: record {
 		## Time when the file was first discovered.
-		ts				: time    &log;
+		ts				: time    &log &default=network_time();
 		## Unique ID of the connection the file was sent over.
 		uid				: string  &log;
 		## ID of the connection the file was sent over.
@@ -74,7 +74,7 @@ export {
 	## This record is for the smb_mapping.log
 	type TreeInfo: record {
 		## Time when the tree was mapped.
-		ts                  : time   &log &optional;
+		ts                  : time   &log &default=network_time();
 		## Unique ID of the connection the tree was mapped over.
 		uid                 : string  &log;
 		## ID of the connection the tree was mapped over.
@@ -94,7 +94,7 @@ export {
 	## This record is for the smb_cmd.log
 	type CmdInfo: record {
 		## Timestamp of the command request.
-		ts				: time &log;
+		ts				: time &log &default=network_time();
 		## Unique ID of the connection the request was sent over.
 		uid				: string &log;
 		## ID of the connection the request was sent over.
diff --git a/scripts/base/protocols/smb/smb1-main.zeek b/scripts/base/protocols/smb/smb1-main.zeek
index 1369dc1714..9dabdd1c36 100644
--- a/scripts/base/protocols/smb/smb1-main.zeek
+++ b/scripts/base/protocols/smb/smb1-main.zeek
@@ -47,9 +47,9 @@ event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=5
 	
 	if ( mid !in smb_state$pending_cmds )
 		{
-		local tmp_cmd = SMB::CmdInfo($ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB1", $command = SMB1::commands[hdr$command]);
+		local tmp_cmd = SMB::CmdInfo($uid=c$uid, $id=c$id, $version="SMB1", $command = SMB1::commands[hdr$command]);
 
-		local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id);
+		local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id);
 		tmp_cmd$referenced_file = tmp_file;
 		tmp_cmd$referenced_tree = smb_state$current_tree;
 		
@@ -104,7 +104,7 @@ event smb1_negotiate_response(c: connection, hdr: SMB1::Header, response: SMB1::
 	
 event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) &priority=5
 	{
-	local tmp_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id, $path=path, $service=service);
+	local tmp_tree = SMB::TreeInfo($uid=c$uid, $id=c$id, $path=path, $service=service);
 
 	c$smb_state$current_cmd$referenced_tree = tmp_tree;
 	c$smb_state$current_cmd$argument = path;
@@ -132,7 +132,7 @@ event smb1_tree_connect_andx_response(c: connection, hdr: SMB1::Header, service:
 
 event smb1_nt_create_andx_request(c: connection, hdr: SMB1::Header, name: string) &priority=5
 	{
-	local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id);
+	local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id);
 	c$smb_state$current_cmd$referenced_file = tmp_file;
 
 	c$smb_state$current_cmd$referenced_file$name = name;
diff --git a/scripts/base/protocols/smb/smb2-main.zeek b/scripts/base/protocols/smb/smb2-main.zeek
index 0458b08c66..59436a2c8c 100644
--- a/scripts/base/protocols/smb/smb2-main.zeek
+++ b/scripts/base/protocols/smb/smb2-main.zeek
@@ -26,8 +26,8 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
 
 	if ( mid !in smb_state$pending_cmds )
 		{
-		local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id);
-		local tmp_cmd = SMB::CmdInfo($ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB2", $command = SMB2::commands[hdr$command]);
+		local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id);
+		local tmp_cmd = SMB::CmdInfo($uid=c$uid, $id=c$id, $version="SMB2", $command = SMB2::commands[hdr$command]);
 		tmp_cmd$referenced_file = tmp_file;
 		smb_state$pending_cmds[mid] = tmp_cmd;
 		}
@@ -41,14 +41,14 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
 			}
 		else if ( tid !in smb_state$tid_map )
 			{
-			local tmp_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id);
+			local tmp_tree = SMB::TreeInfo($uid=c$uid, $id=c$id);
 			smb_state$tid_map[tid] = tmp_tree;
 			}
 		smb_state$current_cmd$referenced_tree = smb_state$tid_map[tid];
 		}
 	else
 		{
-		smb_state$current_cmd$referenced_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id);
+		smb_state$current_cmd$referenced_tree = SMB::TreeInfo($uid=c$uid, $id=c$id);
 		}
 
 	smb_state$current_file = smb_state$current_cmd$referenced_file;