mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
369e42a6e4
Due to different double precision on M1, file IDs for SMB could end up changing on M1 because the access time of a file goes into their computation. The real solution for this would be changing Zeek's internal "time" representation to uint64; that's planned, but requires major surgery. For now, this PR changes the SMB code to also pass SMB's original time representation (which is a uint64) into script-land, and then use that for computing the file ID. Closes #1406
12 lines
999 B
Text
12 lines
999 B
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path files
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
|
|
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count
|
|
XXXXXXXXXX.XXXXXX FVTHwlRSH2WI8fFw2 169.254.128.15 169.254.128.18 CHhAvVGS1DHFjwGM9 SMB 0 (empty) text/plain pythonfile 0.000000 - F 16 16 0 0 F - - - - - - -
|
|
XXXXXXXXXX.XXXXXX FAI5Dc4cLr5RAw3j0e 169.254.128.18 169.254.128.15 CHhAvVGS1DHFjwGM9 SMB 0 (empty) text/plain pythonfile2 0.000000 - T 7000 - 0 0 F - - - - - - -
|
|
#close XXXX-XX-XX-XX-XX-XX
|