68 Commits (fc38013975ab8875863e23efda97eaecb7ff7a09)

Author	SHA1	Message	Date
Victor Julien	edd0c2246c	smb1: add SMB1_COMMAND_QUERY_INFO_DISK command mapping	7 years ago
Victor Julien	177966970a	smb: probing parser improvement	7 years ago
Victor Julien	2b581cd6db	smb: log trans2 that enable delete on close	7 years ago
Victor Julien	eefac0ef95	smb1: add support for trans2 set_path_info rename	7 years ago
Victor Julien	1b86d4e1a2	smb: improve dcerpc logic ... Detect whether a pipe is a dcerpc channel based on the name of the pipe.	7 years ago
Victor Julien	7c8a078a2c	smb1: improve NT Create response record parsing	7 years ago
Victor Julien	2e6014b15c	rust/smb: search for record on midstream start ... Calls with both START and MIDSTREAM mean the record might be cut and the start of it could be missing. For this case, enable the same logic as is used when catching up after a GAP. Search for the start of the record instead of assuming it sits exactly at the start of the input data.	7 years ago
Victor Julien	f40fc0293b	smb: minor optimizations	8 years ago
Victor Julien	b1e2783788	auth/krb5: move kerberos5 wrapper to rust root ... Make it available outside of just the SMB parser.	8 years ago
Victor Julien	4d58aaae90	smb: clean up partial read/write record handling	8 years ago
Victor Julien	aa8d64c2b8	smb: improve skip handling ... When skipping records the skip tracker could underflow if the record parsing had more data than expected. Enforce the calculation by moving it into a method and make the actual fields private.	8 years ago
Victor Julien	eac7a92200	smb2: improve read/write record parsing ... parse_smb2_response_read()/parse_smb2_response_write() can be called on incomplete data, so they didn't use the read/write length field to grab the data field. Instead it just used rest(). However in some cases SMB2 records have trailing data, which would be included in the READ/WRITE data. This patch addresses this by using the length field if enough data is available.	8 years ago
Victor Julien	ea1e13cb00	smb: suppress notice messages	8 years ago
Pierre Chifflier	576b8ef722	SMB: simplify code	8 years ago
Pierre Chifflier	cf5de0c58e	SMB: use String::from_utf8_lossy in logging functions	8 years ago
Pierre Chifflier	b5529e4ffb	SMB: use kerberos-parser to extract Real and PrincipalName	8 years ago
Victor Julien	0dfb3f0e7f	smb1: extract rename info from TRANS2 ... Exclude TRANS2 from generic TX lookup bypass.	8 years ago
Victor Julien	8eeda113c8	smb1: add parsing for RENAME command	8 years ago
Victor Julien	7b61f2c589	smb2: log renames	8 years ago
Victor Julien	15978d4e85	smb: if filename is missing, use '<unknown>'	8 years ago
Victor Julien	71742ed52b	smb: share can't be <share_root>	8 years ago
Victor Julien	bc193242ad	smb1: add OPEN_ANDX command name for logging	8 years ago
Victor Julien	32b19fac99	smb2: don't log/track each READ/WRITE/etc	8 years ago
Victor Julien	fb986abe81	smb: log file FID/GUID as fuid	8 years ago
Victor Julien	816bd022a6	smb1: improve non nt-status handling ... Support SRV error, with a couple of codes. Rename statux field to status_code.	8 years ago
Victor Julien	0519807639	smb1: ignore tree_id in session setup	8 years ago
Victor Julien	286c054472	smb: improve nbss/smb record detection	8 years ago
Victor Julien	7ab071a58d	rust/smb: implement minimal record parsing in probing	8 years ago
Victor Julien	283be3cade	smb2: break out ioctl handling	8 years ago
Victor Julien	bf08285602	smb2: parse async records	8 years ago
Victor Julien	5c26020714	smb2: add ioctl transactions to log the funcs	8 years ago
Victor Julien	75265ec376	smb2: map ioctl funcs to names ... List is based on Wireshark's list.	8 years ago
Victor Julien	7cd66516f0	smb: use formal MS names for disposition	8 years ago
Victor Julien	f7ed749d4f	smb: disable debug output	8 years ago
Victor Julien	eed492547c	smb1: extract server guid from negotiate	8 years ago
Victor Julien	6d56edc3de	smb2: log client and server guid from negotiate	8 years ago
Victor Julien	c56f5e11ca	smb2: log share type	8 years ago
Victor Julien	d75ebdb981	smb: log create empty filename as '<share_root>' like Bro does	8 years ago
Victor Julien	fcbeab70a4	smb1: log create 'service' fields	8 years ago
Victor Julien	90e2abaac4	smb1: use generic string parsing for trans	8 years ago
Victor Julien	76917a8732	smb1: generic smb string parse func	8 years ago
Victor Julien	668c747aee	smb1: more exact tree connect record parsing	8 years ago
Victor Julien	0ed00cf104	smb: move common parsing funcs into own file	8 years ago
Victor Julien	1c701dc50e	smb: make string parsing functions public	8 years ago
Victor Julien	1d4aac1d4d	smb1: set event on empty/malformed dialect	8 years ago
Victor Julien	c91242e71c	smb: rename file to filename in output	8 years ago
Victor Julien	caf29e92b3	smb1: parse and log timestamps in CREATE	8 years ago
Victor Julien	0e05ef7369	smb2: parse and log timestamps in CREATE	8 years ago
Victor Julien	28f16e38ac	smb1: disable 'generic tx's for common commands ... Don't create a generic TX for each READ, WRITE, TRANS, TRANS2, except if they cause events to trigger.	8 years ago
Victor Julien	78cd92a933	smb: generic event per trans/read/write for tx events	8 years ago