smb: log create empty filename as '<share_root>' like Bro does

8 years ago · d75ebdb981
parent fcbeab70a4
commit d75ebdb981
1 changed files with 9 additions and 4 deletions
--- a/rust/src/smb/log.rs
+++ b/rust/src/smb/log.rs
@ -176,12 +176,17 @@ fn smb_common_header(state: &SMBState, tx: &SMBTransaction) -> Json
        Some(SMBTransactionTypeData::CREATE(ref x)) => {
            let mut name_raw = x.filename.to_vec();
            name_raw.retain(|&i|i != 0x00);
+            if name_raw.len() > 0 {
                let name = String::from_utf8_lossy(&name_raw);
                if x.directory {
                    js.set_string("directory", &name);
                } else {
                    js.set_string("filename", &name);
                }
+            } else {
+                // name suggestion from Bro
+                js.set_string("filename", "<share_root>");
+            }
            match x.disposition {
                1 => { js.set_string("disposition", "open"); },
                2 => { js.set_string("disposition", "create"); },