Commit Graph

168 Commits (c130820bff1288ad6dca66ea5da0e4d4a0b5389d)

Author SHA1 Message Date
Victor Julien ea1e13cb00 smb: suppress notice messages 7 years ago
Pierre Chifflier 576b8ef722 SMB: simplify code 7 years ago
Pierre Chifflier cf5de0c58e SMB: use String::from_utf8_lossy in logging functions 7 years ago
Pierre Chifflier b5529e4ffb SMB: use kerberos-parser to extract Real and PrincipalName 7 years ago
Victor Julien 0dfb3f0e7f smb1: extract rename info from TRANS2
Exclude TRANS2 from generic TX lookup bypass.
7 years ago
Victor Julien 8eeda113c8 smb1: add parsing for RENAME command 7 years ago
Victor Julien 7b61f2c589 smb2: log renames 7 years ago
Victor Julien 15978d4e85 smb: if filename is missing, use '<unknown>' 7 years ago
Jason Ish 27fd521420 eve/dns/v2: support eve/dns v2 in rust 7 years ago
Jason Ish 57d9574839 rust/json: expose more of jansson to rust 7 years ago
Victor Julien 71742ed52b smb: share can't be <share_root> 7 years ago
Victor Julien bc193242ad smb1: add OPEN_ANDX command name for logging 7 years ago
Victor Julien 32b19fac99 smb2: don't log/track each READ/WRITE/etc 7 years ago
Victor Julien fb986abe81 smb: log file FID/GUID as fuid 7 years ago
Victor Julien 816bd022a6 smb1: improve non nt-status handling
Support SRV error, with a couple of codes.
Rename statux field to status_code.
7 years ago
Victor Julien 0519807639 smb1: ignore tree_id in session setup 7 years ago
Victor Julien 286c054472 smb: improve nbss/smb record detection 7 years ago
Victor Julien 7ab071a58d rust/smb: implement minimal record parsing in probing 7 years ago
Victor Julien 283be3cade smb2: break out ioctl handling 7 years ago
Victor Julien bf08285602 smb2: parse async records 7 years ago
Victor Julien 5c26020714 smb2: add ioctl transactions to log the funcs 7 years ago
Victor Julien 75265ec376 smb2: map ioctl funcs to names
List is based on Wireshark's list.
7 years ago
Victor Julien 7cd66516f0 smb: use formal MS names for disposition 7 years ago
Victor Julien f7ed749d4f smb: disable debug output 7 years ago
Victor Julien eed492547c smb1: extract server guid from negotiate 7 years ago
Victor Julien 6d56edc3de smb2: log client and server guid from negotiate 7 years ago
Victor Julien c56f5e11ca smb2: log share type 7 years ago
Victor Julien d75ebdb981 smb: log create empty filename as '<share_root>' like Bro does 7 years ago
Victor Julien fcbeab70a4 smb1: log create 'service' fields 7 years ago
Victor Julien 90e2abaac4 smb1: use generic string parsing for trans 7 years ago
Victor Julien 76917a8732 smb1: generic smb string parse func 7 years ago
Victor Julien 668c747aee smb1: more exact tree connect record parsing 7 years ago
Victor Julien 0ed00cf104 smb: move common parsing funcs into own file 7 years ago
Victor Julien 1c701dc50e smb: make string parsing functions public 7 years ago
Victor Julien 1d4aac1d4d smb1: set event on empty/malformed dialect 7 years ago
Victor Julien c91242e71c smb: rename file to filename in output 7 years ago
Victor Julien caf29e92b3 smb1: parse and log timestamps in CREATE 7 years ago
Victor Julien 0e05ef7369 smb2: parse and log timestamps in CREATE 7 years ago
Victor Julien 28f16e38ac smb1: disable 'generic tx's for common commands
Don't create a generic TX for each READ, WRITE, TRANS, TRANS2,
except if they cause events to trigger.
7 years ago
Victor Julien 78cd92a933 smb: generic event per trans/read/write for tx events 7 years ago
Victor Julien 05992f1772 smb: fix event handling when no tx is available 7 years ago
Victor Julien be615c9fbc smb: small cleanups, fixes and optimizations 7 years ago
Victor Julien dab055d8c8 smb: update to der-parser 0.5.1 7 years ago
Victor Julien 0d69e7b8c2 smb: remove unused dialects from state 7 years ago
Victor Julien ad1bc7f473 smb1: minor debug improvment 7 years ago
Victor Julien a44504a1bf smb: redo gap catch up handling 7 years ago
Victor Julien 7114d5d25b smb1: parser cleanups 7 years ago
Victor Julien d9e43d3e63 smb: cleaner server component parsing 7 years ago
Victor Julien ecbf10da70 smb2: improve write error handling 7 years ago
Victor Julien b34392051d smb3: parse transform records 7 years ago