Commit graph

6 commits

Author SHA1 Message Date
Johanna Amann
e5db1f085c Merge remote-tracking branch 'origin/topic/jsiwek/gh-684-fix-rpc-parsing'
* origin/topic/jsiwek/gh-684-fix-rpc-parsing:
  GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors

Addresses GH-684
2019-11-21 08:50:28 -08:00
Jon Siwek
37a478ae99 GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors
The parsing logic that should be specific to the AUTH_UNIX credential
flavor was previously applied unconditionally to other flavors.
2019-11-13 13:14:14 -08:00
Jon Siwek
31f60853c9 GH-646: add new "successful_connection_remove" event
And switch Zeek's base scripts over to using it in place of
"connection_state_remove".  The difference between the two is
that "connection_state_remove" is raised for all events while
"successful_connection_remove" excludes TCP connections that were never
established (just SYN packets).  There can be performance benefits
to this change for some use-cases.

There's also a new event called ``connection_successful`` and a new
``connection`` record field named "successful" to help indicate this new
property of connections.
2019-11-11 19:52:59 -08:00
Jon Siwek
0350004f1e Add return value checks for some RPC parsing functions 2018-10-04 11:33:57 -05:00
Devin Trejo
e529268b0a Format print nfs units tests to improve output readability. Add unit
tests for new NFS events -- nfs_proc_symlink, nfs_proc_link,
nfs_proc_sattr.
2018-01-11 17:02:47 -05:00
Julien Wallior
9a75c52726 Add nfs unittest. Includes an example for the new nfs_proc_rename. 2017-05-18 08:41:52 -04:00