Commit graph

15 commits

Author SHA1 Message Date
Jon Siwek
a60e5e9582 Migrate SMB analyzer to use IntrusivePtr
Deprecates the utf16_bytestring_to_utf8_val() function with replacement
being utf16_to_utf8_val().
2020-05-14 17:18:00 -07:00
Jon Siwek
743303950b Deprecate binpac::bytestring_to_val, replace with binpac::to_stringval 2020-04-20 14:30:49 -07:00
Jon Siwek
81517bd703 Update deprecated BifEvent::generate_* usages 2020-04-17 18:42:58 -07:00
Jon Siwek
de8761f761 Update deprecated ValManager::GetEmptyString usages 2020-04-16 16:46:38 -07:00
Jon Siwek
93f4c5871b Update deprecated ValManager::GetCount usages 2020-04-16 16:46:36 -07:00
Jon Siwek
d9edd855da Update deprecated ValManager::GetBool usages 2020-04-16 16:44:33 -07:00
Tim Wojtulewicz
fd5e15b116 The Great Embooleanating
A large number of functions had return values and/or arguments changed
to use ``bool`` types instead of ``int``.
2020-03-31 06:41:54 +00:00
Jon Siwek
2982765128 Pre-allocate and re-use Vals for bool, int, count, enum and empty string 2019-01-09 18:29:23 -06:00
Jon Siwek
954e7980cf Fixes for MySQL and SMB protocol parsers
* MySQL: the parser for this was generally broken (not following
  the specification well) and needed many changes.  One addition is a
  new "mysql_result_row" event that provides access to the results of
  queries.

* SMB: the spec seems to explitly call out the omission of the
  PrimaryDomain field on SMB_COM_SESSION_SETUP_ANDX responses (and I
  don't see that field in pcaps either), so this may have just been a
  typo that used to work fine in the past only due to faulty array
  parsing behavior in binpac.
2018-05-18 10:31:36 -05:00
Seth Hall
6ee543220c Small SMB bug fix. 2016-08-08 16:50:35 -04:00
Seth Hall
117b5c3ac7 Lots of SMB1 parsing fixes. 2016-08-08 15:36:07 -04:00
Robin Sommer
ad4263a98d Minor cleanup. 2016-07-07 11:55:57 -07:00
Seth Hall
5b5589e167 Complete breakout of SMB, GSSAPI, and NTLM
- Looser coupling between these analyzers.
 - New ntlm.log (still pretty early)
 - Improved string handling for NTLM (convert UTF16 to UTF8)
 - SMB2 analyzer now supports GSSAPI.
 - Improved abstraction of DCE_RPC operations (still not finished)
 - Lots of whitespace cleanup.
2016-04-03 04:17:20 -04:00
Vlad Grigorescu
0d615b0319 Add more SMB subcommands and arguments. Log SMB1 error messages too. 2014-10-07 17:32:01 -04:00
Vlad Grigorescu
6a34de5dd8 SMB & NTLM analyzers. 2014-07-24 21:46:38 -04:00