Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

ldap: Use longer event names

Browse source 
It's unusual to compress and shorten event names of protocol analyzers,
switch to a slightly longer name instead.
This commit is contained in:
Arne Welzel 2023-10-19 10:47:00 +02:00
parent fb31ad0c6e
commit e1864ec131
3 changed files with 25 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/protocols/ldap/main.zeek
View file

@ -258,7 +258,7 @@ event LDAP::message(c: connection,
} }
############################################################################# #############################################################################
event LDAP::searchreq(c: connection, event LDAP::search_request(c: connection,
message_id: int, message_id: int,
base_object: string, base_object: string,
scope: LDAP::SearchScope, scope: LDAP::SearchScope,
@ -296,7 +296,7 @@ event LDAP::searchreq(c: connection,
} }
############################################################################# #############################################################################
event LDAP::searchres(c: connection, event LDAP::search_result(c: connection,
message_id: int, message_id: int,
object_name: string) { object_name: string) {
@ -306,7 +306,7 @@ event LDAP::searchres(c: connection,
} }
############################################################################# #############################################################################
event LDAP::bindreq(c: connection, event LDAP::bind_request(c: connection,
message_id: int, message_id: int,
version: int, version: int,
name: string, name: string,

6
scripts/base/protocols/ldap/spicy-events.zeek
View file

@ -43,7 +43,7 @@ global LDAP::message: event(
## auth_type: The auth type field in the BindRequest. ## auth_type: The auth type field in the BindRequest.
## ##
## auth_info: Additional information related to the used auth type. ## auth_info: Additional information related to the used auth type.
global LDAP::bindreq: event( global LDAP::bind_request: event(
c: connection, c: connection,
message_id: int, message_id: int,
version: int, version: int,
@ -73,7 +73,7 @@ global LDAP::bindreq: event(
## filter: The string representation of the filter field in the SearchRequest. ## filter: The string representation of the filter field in the SearchRequest.
## ##
## attributes: Additional attributes of the SearchRequest. ## attributes: Additional attributes of the SearchRequest.
global LDAP::searchreq: event ( global LDAP::search_request: event (
c: connection, c: connection,
message_id: int, message_id: int,
base_object: string, base_object: string,
@ -93,7 +93,7 @@ global LDAP::searchreq: event (
## message_id: The messageID element. ## message_id: The messageID element.
## ##
## object_name: The object name in the SearchResultEntry. ## object_name: The object name in the SearchResultEntry.
global LDAP::searchres: event ( global LDAP::search_result: event (
c: connection, c: connection,
message_id: int, message_id: int,
object_name: string object_name: string

38
src/analyzer/protocol/ldap/ldap.evt
View file

@ -20,24 +20,24 @@ on LDAP::Message -> event LDAP::message($conn,
self.obj, self.obj,
self.arg); self.arg);
on LDAP::BindRequest -> event LDAP::bindreq($conn, on LDAP::BindRequest -> event LDAP::bind_request($conn,
message.messageID, message.messageID,
self.version, self.version,
self.name, self.name,
self.authType, self.authType,
message.arg); message.arg);
on LDAP::SearchRequest -> event LDAP::searchreq($conn, on LDAP::SearchRequest -> event LDAP::search_request($conn,
message.messageID, message.messageID,
self.baseObject, self.baseObject,
self.scope, self.scope,
self.deref, self.deref,
self.sizeLimit, self.sizeLimit,
self.timeLimit, self.timeLimit,
self.typesOnly, self.typesOnly,
self.filter, self.filter,
self.attributes); self.attributes);
on LDAP::SearchResultEntry -> event LDAP::searchres($conn, on LDAP::SearchResultEntry -> event LDAP::search_result($conn,
message.messageID, message.messageID,
self.objectName); self.objectName);