aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

smb/log: map dcerpc uuid, opnum to service names

Browse Source 
With this patch, the logged uuids will also have corresponding
stringified service names. The requests that will have an opnum will
have a corresponding stringified procedure name.

Feature 2727
Feature 8523
pull/16017/head
Shivani Bhardwaj 1 month ago committed by Victor Julien
parent d77f73d9a6
commit 2eb0b60b83
2 changed files with 38 additions and 6 deletions
Show Stats Download Patch File Download Diff File

19
etc/schema.json
Unescape Escape View File

@ -5927,6 +5927,25 @@
"ack_result": { "ack_result": {
"type": "integer" "type": "integer"
}, },
"procedure": {
"description": "DCERPC Procedure name corresponding to the interface UUID and Opnum",
"type": "string",
"suricata": {
"keywords": [
"dcerpc.iface",
"dcerpc.opnum"
]
}
},
"service": {
"description": "DCERPC Service name corresponding to the interface UUID",
"type": "string",
"suricata": {
"keywords": [
"dcerpc.iface"
]
}
},
"uuid": { "uuid": {
"type": "string" "type": "string"
}, },

25
rust/src/smb/log.rs
Unescape Escape View File

@ -17,6 +17,7 @@
use crate::conf::ConfNode; use crate::conf::ConfNode;
use crate::dcerpc::dcerpc::*; use crate::dcerpc::dcerpc::*;
use crate::dcerpc::load_interfaces::DCERPC_INTERFACE_MAP;
use crate::jsonbuilder::{JsonBuilder, JsonError}; use crate::jsonbuilder::{JsonBuilder, JsonError};
use crate::smb::funcs::*; use crate::smb::funcs::*;
use crate::smb::smb::*; use crate::smb::smb::*;
@ -426,13 +427,21 @@ fn smb_common_header(
jsb.open_array("interfaces")?; jsb.open_array("interfaces")?;
for i in ifaces { for i in ifaces {
jsb.start_object()?; jsb.start_object()?;
let ifstr = uuid::Uuid::from_slice(&i.uuid); let ifuuid = uuid::Uuid::from_slice(&i.uuid);
let ifstr = ifstr let ifstr = ifuuid
.map(|ifstr| ifstr.to_hyphenated().to_string()) .as_ref()
.map(|ifuuid| ifuuid.to_hyphenated().to_string())
.unwrap(); .unwrap();
jsb.set_string("uuid", &ifstr)?; jsb.set_string("uuid", &ifstr)?;
let vstr = format!("{}.{}", i.ver, i.ver_min); let vstr = format!("{}.{}", i.ver, i.ver_min);
jsb.set_string("version", &vstr)?; jsb.set_string("version", &vstr)?;
if let Some(iface) = DCERPC_INTERFACE_MAP.get(&ifuuid.unwrap())
{
jsb.set_string("service", &iface.service)?;
if let Some(pname) = iface.opcodes.get(&x.opnum) {
jsb.set_string("procedure", pname)?;
}
}
jsb.close()?; jsb.close()?;
} }
jsb.close()?; jsb.close()?;
@ -444,9 +453,10 @@ fn smb_common_header(
jsb.open_array("interfaces")?; jsb.open_array("interfaces")?;
for i in ifaces { for i in ifaces {
jsb.start_object()?; jsb.start_object()?;
let ifstr = uuid::Uuid::from_slice(&i.uuid); let ifuuid = uuid::Uuid::from_slice(&i.uuid);
let ifstr = ifstr let ifstr = ifuuid
.map(|ifstr| ifstr.to_hyphenated().to_string()) .as_ref()
.map(|ifuuid| ifuuid.to_hyphenated().to_string())
.unwrap(); .unwrap();
jsb.set_string("uuid", &ifstr)?; jsb.set_string("uuid", &ifstr)?;
let vstr = format!("{}.{}", i.ver, i.ver_min); let vstr = format!("{}.{}", i.ver, i.ver_min);
@ -456,6 +466,9 @@ fn smb_common_header(
jsb.set_uint("ack_result", i.ack_result as u64)?; jsb.set_uint("ack_result", i.ack_result as u64)?;
jsb.set_uint("ack_reason", i.ack_reason as u64)?; jsb.set_uint("ack_reason", i.ack_reason as u64)?;
} }
if let Some(iface) = DCERPC_INTERFACE_MAP.get(&ifuuid.unwrap()) {
jsb.set_string("service", &iface.service)?;
}
jsb.close()?; jsb.close()?;
} }
jsb.close()?; jsb.close()?;

Write Preview
Loading…
Cancel
Save