Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Change smb2_create_request event arguments to single request struct.

Browse source 
Added disposition and create_option fields.
This commit is contained in:
Julien Wallior 2018-01-11 14:23:10 -05:00
parent 8b28b73124
commit f041c97cdc
4 changed files with 29 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/init-bare.bro
View file

@ -3054,6 +3054,20 @@ export {
## The type of share being accessed. Physical disk, named pipe, or printer. ## The type of share being accessed. Physical disk, named pipe, or printer.
share_type: count; share_type: count;
}; };
## The request sent by the client to request either creation of or access to a file.
##
## For more information, see MS-SMB2:2.2.13
##
## .. bro:see:: smb2_create_request
type SMB2::CreateRequest: record {
## Name of the file
filename : string;
## Defines the action the server MUST take if the file that is specified already exists.
disposition : count;
## Specifies the options to be applied when creating or opening the file.
create_options : count;
};
} }
module GLOBAL; module GLOBAL;

8
scripts/policy/protocols/smb/smb2-main.bro
View file

@ -129,12 +129,12 @@ event smb2_tree_disconnect_request(c: connection, hdr: SMB2::Header) &priority=5
} }
} }
event smb2_create_request(c: connection, hdr: SMB2::Header, name: string) &priority=5 event smb2_create_request(c: connection, hdr: SMB2::Header, request: SMB2::CreateRequest) &priority=5
{ {
if ( name == "") if ( request$filename == "")
name = "<share_root>"; request$filename = "<share_root>";
c$smb_state$current_file$name = name; c$smb_state$current_file$name = request$filename;
switch ( c$smb_state$current_tree$share_type ) switch ( c$smb_state$current_tree$share_type )
{ {

6
src/analyzer/protocol/smb/smb2-com-create.pac
View file

@ -13,10 +13,14 @@ refine connection SMB_Conn += {
if ( smb2_create_request ) if ( smb2_create_request )
{ {
RecordVal* requestinfo = new RecordVal(BifType::Record::SMB2::CreateRequest);
requestinfo->Assign(0, filename);
requestinfo->Assign(1, new Val(${val.disposition}, TYPE_COUNT));
requestinfo->Assign(2, new Val(${val.create_options}, TYPE_COUNT));
BifEvent::generate_smb2_create_request(bro_analyzer(), BifEvent::generate_smb2_create_request(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),
BuildSMB2HeaderVal(h), BuildSMB2HeaderVal(h),
filename); requestinfo);
} }
else else
{ {

8
src/analyzer/protocol/smb/smb2_com_create.bif
View file

@ -8,10 +8,10 @@
## ##
## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message. ## hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
## ##
## file_name: The name of the file being requested. ## request: A record with more information related to the request.
## ##
## .. bro:see:: smb2_message smb2_create_response ## .. bro:see:: smb2_message smb2_create_response
event smb2_create_request%(c: connection, hdr: SMB2::Header, file_name: string%); event smb2_create_request%(c: connection, hdr: SMB2::Header, request: SMB2::CreateRequest%);
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` ## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 responses of type *create*. This is sent by the server to notify the client of ## version 2 responses of type *create*. This is sent by the server to notify the client of
@ -33,3 +33,7 @@ event smb2_create_request%(c: connection, hdr: SMB2::Header, file_name: string%)
## ##
## .. bro:see:: smb2_message smb2_create_request ## .. bro:see:: smb2_message smb2_create_request
event smb2_create_response%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, size: count, times: SMB::MACTimes, attrs: SMB2::FileAttrs%); event smb2_create_response%(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, size: count, times: SMB::MACTimes, attrs: SMB2::FileAttrs%);
#### Types
type SMB2::CreateRequest: record;