Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Whitespace cleanup to the NTLM SSP file.

Browse source
This commit is contained in:
Seth Hall 2016-03-08 11:30:58 -05:00
parent 90559a3372
commit e8064ff189
1 changed files with 156 additions and 151 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/analyzer/protocol/smb/smb-ntlmssp.pac
View file

@ -46,8 +46,10 @@ refine connection SMB_Conn += {
function build_av_record(val: SMB_NTLM_AV_Pair_Sequence): BroVal
%{
RecordVal* result = new RecordVal(BifType::Record::SMB::NTLMAVs);
for ( uint i = 0; ${val.pairs[i].id} != 0; i++ ) {
switch ( ${val.pairs[i].id} ) {
for ( uint i = 0; ${val.pairs[i].id} != 0; i++ )
{
switch ( ${val.pairs[i].id} )
{
case 1:
result->Assign(0, uint8s_to_stringval(${val.pairs[i].nb_computer_name.data}));
break;
@ -84,6 +86,7 @@ refine connection SMB_Conn += {
%{
if ( ${val.gssapi.is_init} )
return true;
for ( uint i = 0; i < ${val.gssapi.resp.args}->size(); ++i )
{
switch ( ${val.gssapi.resp.args[i].seq_meta.index} )
@ -158,7 +161,6 @@ refine connection SMB_Conn += {
return true;
%}
};
type GSSAPI_NEG_TOKEN(header: SMB_Header) = record {
@ -176,7 +178,7 @@ type GSSAPI_NEG_TOKEN(header: SMB_Header) = record {
false -> resp: GSSAPI_NEG_TOKEN_RESP(header);
};
} &let {
is_init: bool = wrapper.tag == 0x60;
is_init: bool = (wrapper.tag == 0x60);
};
type GSSAPI_NEG_TOKEN_INIT(header: SMB_Header) = record {
@ -243,6 +245,7 @@ type SMB_NTLM_Negotiate(header: SMB_Header, offset: uint16) = record {
absolute_offset : uint16 = offsetof(payload) + offset;
domain_name : SMB_NTLM_String(domain_name_fields, absolute_offset, flags.negotiate_unicode) withinput payload &if(flags.negotiate_oem_domain_supplied);
workstation : SMB_NTLM_String(workstation_fields, absolute_offset, flags.negotiate_unicode) withinput payload &if(flags.negotiate_oem_workstation_supplied);
proc : bool = $context.connection.proc_smb_ntlm_negotiate(header, this);
};
@ -261,6 +264,7 @@ type SMB_NTLM_Challenge(header: SMB_Header, offset: uint16) = record {
absolute_offset : uint16 = offsetof(payload) + offset;
target_name : SMB_NTLM_String(target_name_fields, absolute_offset, flags.negotiate_unicode) withinput payload &if(flags.request_target);
target_info : SMB_NTLM_AV_Pair_Sequence(target_info_fields.offset - absolute_offset) withinput payload &if(flags.negotiate_target_info);
proc : bool = $context.connection.proc_smb_ntlm_challenge(header, this);
};
@ -288,6 +292,7 @@ type SMB_NTLM_Authenticate(header: SMB_Header, offset: uint16) = record {
user_name : SMB_NTLM_String(user_name_fields, absolute_offset, flags.negotiate_unicode) withinput payload &if(user_name_fields.length > 0);
workstation : SMB_NTLM_String(workstation_fields, absolute_offset , flags.negotiate_unicode) withinput payload &if(workstation_fields.length > 0);
encrypted_session_key : SMB_NTLM_String(encrypted_session_key_fields, absolute_offset, flags.negotiate_unicode) withinput payload &if(flags.negotiate_key_exch);
proc : bool = $context.connection.proc_smb_ntlm_authenticate(header, this);
};
@ -310,12 +315,12 @@ type SMB_Fixed_Length_String(unicode: bool) = record {
};
type SMB_NTLM_String(fields: SMB_NTLM_StringData, offset: uint16, unicode: bool) = record {
: padding to fields.offset - offset;
pad1 : padding to fields.offset - offset;
string : SMB_Fixed_Length_String(unicode) &length=fields.length;
};
type SMB_NTLM_AV_Pair_Sequence(offset: uint16) = record {
: padding to offset;
pad1 : padding to offset;
pairs : SMB_NTLM_AV_Pair[] &until($element.last);
};