From cb91a9c10157f8fc01397f5f638595e35231e283 Mon Sep 17 00:00:00 2001 From: Vlad Grigorescu Date: Wed, 29 Apr 2015 20:57:40 -0400 Subject: [PATCH 1/2] A small fix to ssh/geo-data.bro. ssh can now be unset for local-local or remote-remote, so make the script deal with this. --- scripts/base/protocols/ssh/main.bro | 4 ++-- scripts/policy/protocols/ssh/geo-data.bro | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/scripts/base/protocols/ssh/main.bro b/scripts/base/protocols/ssh/main.bro index 6f76dcbb77..d9e1e2b3cf 100644 --- a/scripts/base/protocols/ssh/main.bro +++ b/scripts/base/protocols/ssh/main.bro @@ -118,7 +118,7 @@ event ssh_client_version(c: connection, version: string) c$ssh$version = 2; } -event ssh_auth_successful(c: connection, auth_method_none: bool) +event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=5 { # TODO - what to do here? if ( !c?$ssh || ( c$ssh?$auth_success && c$ssh$auth_success ) ) @@ -146,7 +146,7 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=-5 } } -event ssh_auth_failed(c: connection) +event ssh_auth_failed(c: connection) &priority=5 { if ( !c?$ssh || ( c$ssh?$auth_success && !c$ssh$auth_success ) ) return; diff --git a/scripts/policy/protocols/ssh/geo-data.bro b/scripts/policy/protocols/ssh/geo-data.bro index feae86c8f6..9fe8b597b6 100644 --- a/scripts/policy/protocols/ssh/geo-data.bro +++ b/scripts/policy/protocols/ssh/geo-data.bro @@ -32,6 +32,9 @@ function get_location(c: connection): geo_location event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3 { + if ( ! c$ssh?$direction ) + return; + # Add the location data to the SSH record. c$ssh$remote_location = get_location(c); @@ -47,6 +50,9 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3 event ssh_auth_failed(c: connection) &priority=3 { + if ( ! c$ssh?$direction ) + return; + # Add the location data to the SSH record. c$ssh$remote_location = get_location(c); } From 26007f419ee51160717588f34ca7930f831a3761 Mon Sep 17 00:00:00 2001 From: Daniel Thayer Date: Wed, 29 Apr 2015 23:56:55 -0500 Subject: [PATCH 2/2] Update usage output and list of cmd-line options --- src/main.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main.cc b/src/main.cc index 4b30d23e0a..61cc35f198 100644 --- a/src/main.cc +++ b/src/main.cc @@ -199,7 +199,7 @@ void usage() fprintf(stderr, " -T|--re-level | set 'RE_level' for rules\n"); fprintf(stderr, " -U|--status-file | Record process status in file\n"); fprintf(stderr, " -W|--watchdog | activate watchdog timer\n"); - fprintf(stderr, " -X|--broxygen | generate documentation based on config file\n"); + fprintf(stderr, " -X|--broxygen | generate documentation based on config file\n"); #ifdef USE_PERFTOOLS_DEBUG fprintf(stderr, " -m|--mem-leaks | show leaks [perftools]\n"); @@ -547,7 +547,7 @@ int main(int argc, char** argv) opterr = 0; char opts[256]; - safe_strncpy(opts, "B:e:f:I:i:J:K:n:p:R:r:s:T:t:U:w:x:X:z:CFGNPSWabdghvQ", + safe_strncpy(opts, "B:e:f:I:i:J:K:n:p:R:r:s:T:t:U:w:x:X:z:CFNPSWabdghvQ", sizeof(opts)); #ifdef USE_PERFTOOLS_DEBUG