mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
3dae8ab086
When a CREATE request contains the FILE_DELETE_ON_CLOSE option and the subsequent CREATE response indicates success, we now raise the smb2_file_delete event to log a delete action in smb_files.log and also give users a way to handle this scenario. The provided pcap was generated locally by recording a smbtorture run of the smb2.delete-on-close-perms test case. Placed the create_options into the CmdInfo record for potential exposure in smb_cmd.log (wasn't sure how that would look so left it for the future). Fixes #2276.
18 lines
2 KiB
Text
18 lines
2 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path smb_files
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size prev_name times.modified times.accessed times.created times.changed
|
|
#types time string addr port addr port string enum string string count string time time time time
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_DELETE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_DELETE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_DELETE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
|
|
#close XXXX-XX-XX-XX-XX-XX
|