Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/jsiwek/gh-209-radius-attr-66'

Browse source 
* origin/topic/jsiwek/gh-209-radius-attr-66:
  GH-209: replace "remote_ip" field of radius.log with "tunnel_client"
This commit is contained in:
Johanna Amann 2019-06-07 17:29:28 +10:00
commit 05e519439e
7 changed files with 26 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CHANGES
View file

@ -1,4 +1,9 @@
2.6-391 | 2019-06-07 17:29:28 +1000
* GH-209: replace "remote_ip" field of radius.log with "tunnel_client".
Also changes type from addr to string. (Jon Siwek, Corelight)
2.6-389 | 2019-06-06 20:02:19 -0700 2.6-389 | 2019-06-06 20:02:19 -0700
* Update plugin unit tests to use --zeek-dist (Jon Siwek, Corelight) * Update plugin unit tests to use --zeek-dist (Jon Siwek, Corelight)

5
NEWS
View file

@ -250,6 +250,11 @@ Changed Functionality
that have written unit tests that compare baselines of such log that have written unit tests that compare baselines of such log
files may need to be updated. files may need to be updated.
- The "remote_ip" field of "addr" type was removed from radius.log and
replaced with a field named "tunnel_client" of "string" type. The
reason for this is that the Tunnel-Client-Endpoint RADIUS attribute
this data is derived from may also be a FQDN, not just an IP address.
Removed Functionality Removed Functionality
--------------------- ---------------------

2
VERSION
View file

@ -1 +1 @@
2.6-389 2.6-391

2
doc

@ -1 +1 @@
Subproject commit 7b81005333a5416e1da6a4c83df678e75dccd6be Subproject commit 7194cea467758da4c70be7779bf3ffedb799ce56

11
scripts/base/protocols/radius/main.zeek
View file

@ -24,9 +24,10 @@ export {
## and the network access server is not required to honor ## and the network access server is not required to honor
## the address. ## the address.
framed_addr : addr &log &optional; framed_addr : addr &log &optional;
## Remote IP address, if present. This is collected ## Address (IPv4, IPv6, or FQDN) of the initiator end of the tunnel,
## from the Tunnel-Client-Endpoint attribute. ## if present. This is collected from the Tunnel-Client-Endpoint
remote_ip : addr &log &optional; ## attribute.
tunnel_client: string &log &optional;
## Connect info, if present. ## Connect info, if present.
connect_info : string &log &optional; connect_info : string &log &optional;
## Reply message from the server challenge. This is ## Reply message from the server challenge. This is
@ -85,8 +86,8 @@ event radius_message(c: connection, result: RADIUS::Message) &priority=5
c$radius$mac = normalize_mac(result$attributes[31][0]); c$radius$mac = normalize_mac(result$attributes[31][0]);
# Tunnel-Client-EndPoint (useful for VPNs) # Tunnel-Client-EndPoint (useful for VPNs)
if ( ! c$radius?$remote_ip && 66 in result$attributes ) if ( ! c$radius?$tunnel_client && 66 in result$attributes )
c$radius$remote_ip = to_addr(result$attributes[66][0]); c$radius$tunnel_client = result$attributes[66][0];
# Connect-Info # Connect-Info
if ( ! c$radius?$connect_info && 77 in result$attributes ) if ( ! c$radius?$connect_info && 77 in result$attributes )

8
testing/btest/Baseline/scripts.base.protocols.radius.auth/radius.log
View file

@ -3,8 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path radius #path radius
#open 2017-02-20-04-53-55 #open 2019-06-05-18-03-41
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr remote_ip connect_info reply_msg result ttl #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr tunnel_client connect_info reply_msg result ttl
#types time string addr port addr port string string addr addr string string string interval #types time string addr port addr port string string addr string string string string interval
1217631137.872968 CHhAvVGS1DHFjwGM9 10.0.0.1 1645 10.0.0.100 1812 John.McGuirk 00:14:22:e9:54:5e 255.255.255.254 - - Hello, %u success 0.043882 1217631137.872968 CHhAvVGS1DHFjwGM9 10.0.0.1 1645 10.0.0.100 1812 John.McGuirk 00:14:22:e9:54:5e 255.255.255.254 - - Hello, %u success 0.043882
#close 2017-02-20-04-53-55 #close 2019-06-05-18-03-41

8
testing/btest/Baseline/scripts.base.protocols.radius.radius-multiple-attempts/radius.log
View file

@ -3,9 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path radius #path radius
#open 2017-02-20-04-56-31 #open 2019-06-05-18-04-34
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr remote_ip connect_info reply_msg result ttl #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr tunnel_client connect_info reply_msg result ttl
#types time string addr port addr port string string addr addr string string string interval #types time string addr port addr port string string addr string string string string interval
1440447766.440305 CHhAvVGS1DHFjwGM9 127.0.0.1 53031 127.0.0.1 1812 steve - 172.16.3.33 - - - failed 1.005906 1440447766.440305 CHhAvVGS1DHFjwGM9 127.0.0.1 53031 127.0.0.1 1812 steve - 172.16.3.33 - - - failed 1.005906
1440447839.947454 ClEkJM2Vm5giqnMf4h 127.0.0.1 65443 127.0.0.1 1812 steve - 172.16.3.33 - - - success 0.000779 1440447839.947454 ClEkJM2Vm5giqnMf4h 127.0.0.1 65443 127.0.0.1 1812 steve - 172.16.3.33 - - - success 0.000779
1440447848.196115 C4J4Th3PJpwUYZZ6gc 127.0.0.1 57717 127.0.0.1 1812 steve - - - - - success 0.000275 1440447848.196115 C4J4Th3PJpwUYZZ6gc 127.0.0.1 57717 127.0.0.1 1812 steve - - - - - success 0.000275
@ -13,4 +13,4 @@
1440447880.931272 CUM0KZ3MLUfNB0cl11 127.0.0.1 52178 127.0.0.1 1812 steve - - - - - failed 1.001459 1440447880.931272 CUM0KZ3MLUfNB0cl11 127.0.0.1 52178 127.0.0.1 1812 steve - - - - - failed 1.001459
1440447904.122012 CmES5u32sYpV7JYN 127.0.0.1 62956 127.0.0.1 1812 steve - - - - - unknown - 1440447904.122012 CmES5u32sYpV7JYN 127.0.0.1 62956 127.0.0.1 1812 steve - - - - - unknown -
1440448190.335333 CP5puj4I8PtEU4qzYg 127.0.0.1 53127 127.0.0.1 1812 steve - - - - - success 0.000517 1440448190.335333 CP5puj4I8PtEU4qzYg 127.0.0.1 53127 127.0.0.1 1812 steve - - - - - success 0.000517
#close 2017-02-20-04-56-31 #close 2019-06-05-18-04-34