Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

BIT-1815: move SMB::write_cmd_log functionality into policy/ script

Browse source 
The option is removed, but same functionality is now enabled simply
by loading policy/protocols/smb/log-cmds.bro
This commit is contained in:
Jon Siwek 2018-08-17 11:12:53 -05:00
parent fc7d3cd981
commit fcabd72b92
9 changed files with 115 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/base/protocols/smb/smb2-main.bro
View file

@ -65,25 +65,16 @@ event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=-5
{
# Is this a response?
if ( !is_orig )
{
# If the command that is being looked at right now was
# marked as PENDING, then we'll skip all of this and wait
# for a reply that isn't marked pending.
if ( c$smb_state$current_cmd$status == "PENDING" )
{
return;
}
if ( is_orig )
return;
if ( SMB::write_cmd_log &&
c$smb_state$current_cmd$status !in SMB::ignored_command_statuses &&
c$smb_state$current_cmd$command !in SMB::deferred_logging_cmds )
{
Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
}
delete c$smb_state$pending_cmds[hdr$message_id];
}
# If the command that is being looked at right now was
# marked as PENDING, then we'll skip all of this and wait
# for a reply that isn't marked pending.
if ( c$smb_state$current_cmd$status == "PENDING" )
return;
delete c$smb_state$pending_cmds[hdr$message_id];
}
event smb2_negotiate_request(c: connection, hdr: SMB2::Header, dialects: index_vec) &priority=5