mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
c1492942bb
- Changed the new stub events to correctly check for existence of their associated handler before generating an event - Added a test case for the new stub event * 'add-dce-rpc-payloads' of https://github.com/ynadji/zeek: Add stub payload to dce_rpc_request and dce_rpc_response
28 lines
912 B
Text
28 lines
912 B
Text
# @TEST-EXEC: zeek -b -C -r $TRACES/dce-rpc/cs_window7-join_stream092.pcap %INPUT > out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/dce-rpc
|
|
|
|
event dce_rpc_request(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count)
|
|
{
|
|
print "dce_rpc_request ", c$id, fid, ctx_id, opnum, stub_len;
|
|
}
|
|
|
|
event dce_rpc_request_stub(c: connection, fid: count, ctx_id: count, opnum: count, stub: string)
|
|
{
|
|
print "dce_rpc_request_stub", c$id, fid, ctx_id, opnum, |stub|;
|
|
print bytestring_to_hexstr(stub);
|
|
}
|
|
|
|
event dce_rpc_response(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count)
|
|
{
|
|
print "dce_rpc_response ", c$id, fid, ctx_id, opnum, stub_len;
|
|
}
|
|
|
|
event dce_rpc_response_stub(c: connection, fid: count, ctx_id: count, opnum: count, stub: string)
|
|
{
|
|
print "dce_rpc_response_stub", c$id, fid, ctx_id, opnum, |stub|;
|
|
print bytestring_to_hexstr(stub);
|
|
terminate();
|
|
}
|
|
|