mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
cf6945ef71
This makes a change to the record for smb1-negotiate-response as well. Times and dates are two 2-byte sections, not three. Switch the parsing to just use two uint16s, and pass those into the lanman time conversion function.
19 lines
661 B
Text
19 lines
661 B
Text
# @TEST-DOC: Tests parsing of SMB1 Negotiate Request/Response LanMan messages. Primarily exists to test parsing of the timetstamps.
|
|
#
|
|
# @TEST-EXEC: zeek -r ${TRACES}/smb/cifs_negotiate_lanman.pcap %INPUT > out
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff out
|
|
|
|
event smb1_negotiate_request(c: connection, hdr: SMB1::Header, dialects: string_vec)
|
|
{
|
|
print "smb1_negotiate_request";
|
|
print hdr;
|
|
print dialects;
|
|
}
|
|
|
|
event smb1_negotiate_response(c: connection, hdr: SMB1::Header, response: SMB1::NegotiateResponse)
|
|
{
|
|
print "smb1_negotiate_response";
|
|
print hdr;
|
|
print response;
|
|
print fmt("Parsed Response Server Time: %DT", response$lanman$server_time);
|
|
}
|