"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "src/analyzer/protocol/smb/smb2-protocol.pac" between
zeek-3.2.2.tar.gz and zeek-3.2.4.tar.gz

About: Zeek (formerly Bro) is a flexible network analysis framework focusing on network security monitoring. Feature release.

smb2-protocol.pac  (zeek-3.2.2):smb2-protocol.pac  (zeek-3.2.4)
skipping to change at line 165 skipping to change at line 165
}; };
enum smb2_share_types { enum smb2_share_types {
SMB2_SHARE_TYPE_DISK = 0x01, SMB2_SHARE_TYPE_DISK = 0x01,
SMB2_SHARE_TYPE_PIPE = 0x02, SMB2_SHARE_TYPE_PIPE = 0x02,
SMB2_SHARE_TYPE_PRINT = 0x03, SMB2_SHARE_TYPE_PRINT = 0x03,
}; };
type SMB2_PDU(is_orig: bool) = record { type SMB2_PDU(is_orig: bool) = record {
header : SMB2_Header(is_orig); header : SMB2_Header(is_orig);
message : case header.status of { message : case $context.connection.is_error_response(header, is_orig)
# Status 0 indicates success. In the case of a of {
# request this should just happen to work out due to true -> err : SMB2_error_response(header);
# how the fields are set. false -> msg : SMB2_Message(header, is_orig);
0 -> msg : SMB
2_Message(header, is_orig);
STATUS_BUFFER_OVERFLOW -> buffer_overflow : SMB
2_Message(header, is_orig);
STATUS_MORE_PROCESSING_REQUIRED -> more_processing_required : SMB
2_Message(header, is_orig);
default -> err : SMB
2_error_response(header);
}; };
}; };
type SMB2_Message(header: SMB2_Header, is_orig: bool) = case is_orig of { type SMB2_Message(header: SMB2_Header, is_orig: bool) = case is_orig of {
true -> request : SMB2_Message_Request(header); true -> request : SMB2_Message_Request(header);
false -> response : SMB2_Message_Response(header); false -> response : SMB2_Message_Response(header);
} &byteorder = littleendian; } &byteorder = littleendian;
type SMB2_Message_Request(header: SMB2_Header) = case header.command of { type SMB2_Message_Request(header: SMB2_Header) = case header.command of {
SMB2_NEGOTIATE_PROTOCOL -> negotiate_protocol : SMB2_negotiate_request(h eader); SMB2_NEGOTIATE_PROTOCOL -> negotiate_protocol : SMB2_negotiate_request(h eader);
skipping to change at line 269 skipping to change at line 264
function get_request_tree_id(message_id: uint64): uint64 function get_request_tree_id(message_id: uint64): uint64
%{ %{
// This is stored at the request and used at the reply. // This is stored at the request and used at the reply.
auto it = smb2_request_tree_id.find(message_id); auto it = smb2_request_tree_id.find(message_id);
if ( it == smb2_request_tree_id.end() ) if ( it == smb2_request_tree_id.end() )
return 0; return 0;
return it->second; return it->second;
%} %}
function is_error_response(header: SMB2_Header, is_orig: bool): bool
%{
// In an request, we ignore this field. Relevant documentation is
// at [MS-SMB2] 2.2.1.1 SMB2 Packet Header
// For SMB 3.x, it's the ChannelSequence field, followed by
// the reserved field. In older dialects, the client MUST set
// it to 0, and the server MUST ignore it.
// I don't believe that we care about the ChannelSequence,
// since that seems inconsequential to our parsing.
if ( is_orig )
return false;
// In a response, this is parsed as the status of the request.
// Non-zero USUALLY means an error, except for the specific cases
detailed in
// [MS-SMB2] 3.3.4.4 Sending an Error Response
auto status = static_cast<SMB_Status>(${header.status});
switch (status ) {
case 0:
// No error.
return false;
case STATUS_BUFFER_OVERFLOW:
// SMB2_IOCTL is a bit loose, as it's only acceptable if
the IOCTL
// CtlCode is {FSCTL_PIPE_TRANSCEIVE, FSCTL_PIPE_PEEK, or
// FSCTL_DFS_GETREFERRALS}, but we haven't parsed that ye
t.
return ( ${header.command} != SMB2_IOCTL &&
${header.command} != SMB2_QUERY_INFO &&
${header.command} != SMB2_READ );
case STATUS_INVALID_PARAMETER:
// This is a bit loose, as it's only acceptable if the IO
CTL
// CtlCode is {FSCTL_SRV_COPYCHUNK or
// FSCTL_SRV_COPYCHUNK_WRITE}, but we haven't parsed that
yet.
return ${header.command} != SMB2_IOCTL;
case STATUS_MORE_PROCESSING_REQUIRED:
// Return true (is_error) if it does NOT match this comma
nd
return ${header.command} != SMB2_SESSION_SETUP;
case STATUS_NOTIFY_ENUM_DIR:
return ${header.command} != SMB2_CHANGE_NOTIFY;
default:
return true;
}
%}
}; };
type SMB2_file_attributes = record { type SMB2_file_attributes = record {
flags : uint32; flags : uint32;
} &let { } &let {
read_only : bool = ( flags & 0x00000001 ) > 0; read_only : bool = ( flags & 0x00000001 ) > 0;
hidden : bool = ( flags & 0x00000002 ) > 0; hidden : bool = ( flags & 0x00000002 ) > 0;
system : bool = ( flags & 0x00000004 ) > 0; system : bool = ( flags & 0x00000004 ) > 0;
directory : bool = ( flags & 0x00000010 ) > 0; directory : bool = ( flags & 0x00000010 ) > 0;
archive : bool = ( flags & 0x00000020 ) > 0; archive : bool = ( flags & 0x00000020 ) > 0;
 End of changes. 2 change blocks. 
12 lines changed or deleted 58 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)