Commit graph

9 commits

Author SHA1 Message Date
Jon Siwek
8c02aa5211 Merge remote-tracking branch 'origin/topic/vladg/mysql_nul_string_fix'
* origin/topic/vladg/mysql_nul_string_fix:
  Add a test with an encrypted MySQL connection
  Fix parsing of MySQL NUL Strings, where we now require it to have a NUL value at the end.
2018-10-30 10:00:39 -05:00
Vlad Grigorescu
6144ac536f Fix parsing of MySQL NUL Strings, where we now require it to have a NUL value at the end.
We don't pass that NUL to the script layer, so we moved away from bytestring_to_val for those.
2018-10-29 15:56:51 -05:00
Jon Siwek
954e7980cf Fixes for MySQL and SMB protocol parsers
* MySQL: the parser for this was generally broken (not following
  the specification well) and needed many changes.  One addition is a
  new "mysql_result_row" event that provides access to the results of
  queries.

* SMB: the spec seems to explitly call out the omission of the
  PrimaryDomain field on SMB_COM_SESSION_SETUP_ANDX responses (and I
  don't see that field in pcaps either), so this may have just been a
  typo that used to work fine in the past only due to faulty array
  parsing behavior in binpac.
2018-05-18 10:31:36 -05:00
Robin Sommer
c194919b57 Merge remote-tracking branch 'origin/topic/vladg/bit-1533'
BIT-1533 #merged

* origin/topic/vladg/bit-1533:
  Call ProtocolConfirmation in MySQL analyzer.
2016-03-21 12:46:45 -07:00
Vlad Grigorescu
e8bdf14bfd Call ProtocolConfirmation in MySQL analyzer. 2016-03-17 13:49:06 -05:00
Robin Sommer
e8e81043a1 Merge remote-tracking branch 'origin/topic/vladg/mysql'
* origin/topic/vladg/mysql:
  Update baselines.
  Fix a logic bug with handling quits after the cleanup.
  Integrate MySQL with the software framework
  A bit of MySQL cleanup - removed unused events, consolidated similar events, fixed up main.bro a bit
  Move MySQL analyzer to the new plugin architecture.
  Add a btest for the Wireshark sample MySQL PCAP
  Add support for more commands, and support quit
  Redo the response handling..
  Whitespace/readability fixes.
  Add memleak and auth btests.
  Update baselines.
  Get MySQL to compile and add basic v9 support.
  MySQL analyzer
2014-11-11 11:49:26 -08:00
Vlad Grigorescu
e2ad93c543 A bit of MySQL cleanup - removed unused events, consolidated similar events, fixed up main.bro a bit 2014-10-31 12:08:13 -04:00
Vlad Grigorescu
5929b635ab Get MySQL to compile and add basic v9 support. 2014-08-05 21:31:12 -05:00
Vlad Grigorescu
101d340b18 MySQL analyzer 2014-07-24 15:52:42 -04:00