Commit graph

11 commits

Author SHA1 Message Date
Seth Hall
e2dfaf8a5b Fixes to SMB file handling and logging.
There were some cases where the log would be missing a field
or data wouldn't get sent to file analysis.  At least some of
this is fixed now and I get confused a bit less when I look
at the logs now.

Also, I made the default handling "FILE" so that things like
FILE_UNKNOWN wouldn't show up in the logs so regularly.  It's
technically correct that way, but it doesn't look good and it's
correct as FILE often enough that it make sense to make it the
default I think.
2016-04-01 09:43:13 -04:00
Seth Hall
9c6402bd91 More smb_files.log improvements.
- Actually get the path into the smb_files.log now.
 - When a share root is having the "create" message used on it,
   instead of giving a null file name, now give a special
   indicator of "<share_root>".
 - Update test baselines.
2016-03-09 04:49:48 -05:00
Seth Hall
90559a3372 Disabled the attempt at support for the SMB2 SetInfo message.
It was causing reporter warnings and was so wildly incomplete
that it provided no benefit.
2016-03-08 11:28:32 -05:00
Seth Hall
462316acdf Prevent some extra smb logging of cmd messages. 2016-03-03 16:33:29 -05:00
Seth Hall
d453dc149c A lot of changes to SMB analyzer.
- Add beginning of infrastructure for pipe support in SMB2.
 - Improve identification of non-file tree mappings.
 - Stop passing pipe data to the file analysis framework.
 - Reduce log volume in smb_files.log by watching for repeated
   files being seen so that you don't end up with nearly
   the exact same log line over and over and over.
 - Lots of little whitespace and indentation changes.
2016-03-03 14:27:15 -05:00
Seth Hall
41e2eaa02d Source clean up and some fixes for SMB.
- Remove the separate string handling for NTLM.
 - Fixed a crash in RPC Bind handling when no context
   elements are included.
2016-03-01 14:16:45 -05:00
Seth Hall
2e2fb6831f Merge remote-tracking branch 'origin/topic/vladg/smb' into topic/seth/smb
# Conflicts:
#	scripts/base/protocols/smb/files.bro
#	scripts/base/protocols/smb/main.bro
#	scripts/base/protocols/smb/smb1-main.bro
#	scripts/base/protocols/smb/smb2-main.bro
2016-03-01 11:11:50 -05:00
Seth Hall
dbb5992f43 Disable the smb_cmd.log by default. 2016-02-19 00:23:05 -05:00
Vlad Grigorescu
a6de23aaa3 Refine transaction2 support, rewrite SMB scripts. 2014-10-07 16:31:02 -04:00
Seth Hall
e4ca588127 Does the initial effort to add the SMB2 SetInfo command and better handle file lengths. 2014-09-27 03:11:01 -04:00
Vlad Grigorescu
6a34de5dd8 SMB & NTLM analyzers. 2014-07-24 21:46:38 -04:00