Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SSH: Intel framework integration (PUBKEY_HASH)

Browse source
This commit is contained in:
Vlad Grigorescu 2015-03-17 12:33:09 -04:00
parent 65d982acc1
commit 0cffee7694
4 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/ssh/main.bro
View file

@ -55,6 +55,11 @@ export {
## Event that can be handled to access the SSH record as it is sent on
## to the logging framework.
global log_ssh: event(rec: Info);
## Event that can be handled when the analyzer sees an SSH server host
## key. This abstracts :bro:id:`SSH::ssh1_server_host_key` and
## :bro:id:`SSH::ssh2_server_host_key`.
global ssh_server_host_key: event(c: connection, hash string);
}
redef record Info += {
@ -212,13 +217,12 @@ function generate_fingerprint(c: connection, key: string)
c$ssh$host_key = sub(join_string_vec(lx, ":"), /:/, "");
}
event ssh1_server_host_key(c: connection, p: string, e: string)
event ssh1_server_host_key(c: connection, p: string, e: string) &priority=5
{
generate_fingerprint(c, e + p);
}
event ssh_server_host_key(c: connection, key: string)
event ssh2_server_host_key(c: connection, key: string) &priority=5
{
generate_fingerprint(c, key);
}