Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

NTP: Detect out-of-order packets

Browse source 
The NTP mode provides us with the identity of the endpoints. For the
simple CLIENT / SERVER modes, flip the connection if we detect
orig/resp disagreeing with what the message says. This mainly
results in the history getting a ^ and the ntp.log / conn.log
showing the corrected endpoints.

Closes #2998.
This commit is contained in:
Arne Welzel 2023-05-04 17:23:14 +02:00
parent 12252743b1
commit 2c8b97c522
8 changed files with 66 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocol/ntp/ntp-analyzer.pac
View file

@ -130,11 +130,25 @@
refine flow NTP_Flow += {
%member{
bool flipped_;
%}
%init{
flipped_ = false;
%}
function proc_ntp_message(msg: NTP_PDU): bool
%{
connection()->zeek_analyzer()->AnalyzerConfirmation();
// Flip roles for SERVER mode message from orig or a CLIENT mode message from resp.
if ( ((${msg.mode} == SERVER && is_orig()) || (${msg.mode} == CLIENT && ! is_orig())) && ! flipped_ )
{
connection()->zeek_analyzer()->Conn()->FlipRoles();
flipped_ = true;
}
if ( ! ntp_message )
return false;

9
src/analyzer/protocol/ntp/ntp-protocol.pac
View file

@ -1,5 +1,14 @@
# This is the common part in the header format.
# See RFC 5905 for details
enum NTP_Mode {
SYMMETRIC_ACTIVE = 1,
SYMMETRIC_PASSIVE = 2,
CLIENT = 3,
SERVER = 4,
BROADCAST_SERVER = 5,
BROADCAST_CLIENT = 6,
};
type NTP_PDU(is_orig: bool) = record {
# The first byte of the NTP header contains the leap indicator,
# the version and the mode