Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix smb1_com_transaction* messages

Browse source
This commit is contained in:
Jeffrey Bencteux 2018-01-12 15:29:17 +01:00
parent bbe89a79a4
commit f7a8726ffc
4 changed files with 60 additions and 73 deletions
Download patch file Download diff file Expand all files Collapse all files

50
src/analyzer/protocol/smb/smb1-com-transaction.pac
View file

@ -31,16 +31,14 @@ refine connection SMB_Conn += {
function proc_smb1_transaction_request(header: SMB_Header, val: SMB1_transaction_request): bool
%{
StringVal *parameters = new StringVal(${val.param_count}, (const char*)${val.parameters}.data());
if ( ! smb1_transaction_request )
return false;
StringVal *parameters = new StringVal(${val.parameters}.length(), (const char*)${val.parameters}.data());
StringVal *payload_str = nullptr;
SMB1_transaction_data *payload = nullptr;
if ( !parameters )
{
parameters = new StringVal("");
}
if ( ${val.data_count > 0} )
if ( ${val.data_count} > 0 )
{
payload = ${val.data};
}
@ -66,30 +64,27 @@ refine connection SMB_Conn += {
payload_str = new StringVal("");
}
if ( smb1_transaction_request )
BifEvent::generate_smb1_transaction_request(bro_analyzer(),
bro_analyzer()->Conn(),
BuildHeaderVal(header),
smb_string2stringval(${val.name}),
${val.sub_cmd},
parameters,
payload_str);
BifEvent::generate_smb1_transaction_request(bro_analyzer(),
bro_analyzer()->Conn(),
BuildHeaderVal(header),
smb_string2stringval(${val.name}),
${val.sub_cmd},
parameters,
payload_str);
return true;
%}
function proc_smb1_transaction_response(header: SMB_Header, val: SMB1_transaction_response): bool
%{
StringVal *parameters = new StringVal(${val.param_count}, (const char*)${val.parameters}.data());
if ( !smb1_transaction_response )
return false;
StringVal *parameters = new StringVal(${val.parameters}.length(), (const char*)${val.parameters}.data());
StringVal *payload_str = nullptr;
SMB1_transaction_data *payload = nullptr;
if ( !parameters )
{
parameters = new StringVal("");
}
if ( ${val.data_count > 0} )
if ( ${val.data_count} > 0 )
{
payload = ${val.data[0]};
}
@ -115,12 +110,11 @@ refine connection SMB_Conn += {
payload_str = new StringVal("");
}
if ( smb1_transaction_response )
BifEvent::generate_smb1_transaction_response(bro_analyzer(),
bro_analyzer()->Conn(),
BuildHeaderVal(header),
parameters,
payload_str);
BifEvent::generate_smb1_transaction_response(bro_analyzer(),
bro_analyzer()->Conn(),
BuildHeaderVal(header),
parameters,
payload_str);
return true;
%}
};