Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

ts fields in SMB logs now default to network_time()

Browse source 
This avoids a problem identified by amanbansal2709 in pull
request #1288. I fixed it in a different way than that pull request
by making sure the ts field is always set so that this isssue doesn't
return in the future.
This commit is contained in:
Seth Hall 2021-03-10 13:52:44 +00:00
parent 1d46bcbb81
commit db7aba0835
3 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/protocols/smb/smb2-main.zeek
View file

@ -26,8 +26,8 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
if ( mid !in smb_state$pending_cmds )
{
local tmp_file = SMB::FileInfo($ts=network_time(), $uid=c$uid, $id=c$id);
local tmp_cmd = SMB::CmdInfo($ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB2", $command = SMB2::commands[hdr$command]);
local tmp_file = SMB::FileInfo($uid=c$uid, $id=c$id);
local tmp_cmd = SMB::CmdInfo($uid=c$uid, $id=c$id, $version="SMB2", $command = SMB2::commands[hdr$command]);
tmp_cmd$referenced_file = tmp_file;
smb_state$pending_cmds[mid] = tmp_cmd;
}
@ -41,14 +41,14 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
}
else if ( tid !in smb_state$tid_map )
{
local tmp_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id);
local tmp_tree = SMB::TreeInfo($uid=c$uid, $id=c$id);
smb_state$tid_map[tid] = tmp_tree;
}
smb_state$current_cmd$referenced_tree = smb_state$tid_map[tid];
}
else
{
smb_state$current_cmd$referenced_tree = SMB::TreeInfo($ts=network_time(), $uid=c$uid, $id=c$id);
smb_state$current_cmd$referenced_tree = SMB::TreeInfo($uid=c$uid, $id=c$id);
}
smb_state$current_file = smb_state$current_cmd$referenced_file;