diff --git a/CHANGES b/CHANGES index 62d0156635..02c176d1e2 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ + +4.2.0-dev.179 | 2021-09-20 11:20:50 +0200 + + * Add TSval and TSecr to "SYN_packet" record. (gpotter2) + 4.2.0-dev.174 | 2021-09-16 15:36:52 -0700 * Minor fixes for build problems after reformatting (Tim Wojtulewicz, Corelight) diff --git a/NEWS b/NEWS index 002886641c..2a49e0c8f3 100644 --- a/NEWS +++ b/NEWS @@ -29,6 +29,9 @@ Changed Functionality to revert to the previous behavior by setting ``LogAscii::enable_utf_8`` to false. +- The ``SYN_packet`` record now records TCP timestamps (TSval/TSecr) + when available. + Removed Functionality --------------------- diff --git a/VERSION b/VERSION index 1aed0d4a46..ae16558313 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -4.2.0-dev.177 +4.2.0-dev.179 diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 8f40fe4551..dff74a2d52 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -589,6 +589,8 @@ type SYN_packet: record { win_scale: int; ##< The window scale option if present, or -1 if not. MSS: count; ##< The maximum segment size if present, or 0 if not. SACK_OK: bool; ##< True if the *SACK* option is present. + TSval: count &optional; ##< The TCP TS value if present. + TSecr: count &optional; ##< The TCP TS echo reply if present. }; ## Packet capture statistics. All counts are cumulative. diff --git a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc index b077491b1f..80c1e68235 100644 --- a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc +++ b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc @@ -331,6 +331,8 @@ static zeek::RecordValPtr build_syn_packet_val(bool is_orig, const zeek::IP_Hdr* int winscale = -1; int MSS = 0; int SACK = 0; + std::optional TSval; + std::optional TSecr; // Parse TCP options. u_char* options = (u_char*)tcp + sizeof(struct tcphdr); @@ -384,6 +386,20 @@ static zeek::RecordValPtr build_syn_packet_val(bool is_orig, const zeek::IP_Hdr* winscale = options[2]; break; + case 8: // TCPOPT_TIMESTAMP + if ( opt_len < 10 ) + break; // bad length + + TSval = + (((((static_cast(options[2]) << 8) | options[3]) << 8) | options[4]) + << 8) | + options[5]; + TSecr = + (((((static_cast(options[6]) << 8) | options[7]) << 8) | options[8]) + << 8) | + options[9]; + break; + default: // just skip over break; } @@ -403,6 +419,12 @@ static zeek::RecordValPtr build_syn_packet_val(bool is_orig, const zeek::IP_Hdr* v->Assign(6, MSS); v->Assign(7, static_cast(SACK)); + if ( TSval ) + v->Assign(8, *TSval); + + if ( TSval ) + v->Assign(9, *TSecr); + return v; } diff --git a/testing/btest/Baseline/scripts.base.protocols.tcp.timestamp/.stdout b/testing/btest/Baseline/scripts.base.protocols.tcp.timestamp/.stdout new file mode 100644 index 0000000000..151b89d097 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.tcp.timestamp/.stdout @@ -0,0 +1,3 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +[is_orig=T, DF=T, ttl=64, size=60, win_size=29200, win_scale=7, MSS=1460, SACK_OK=F, TSval=602505000, TSecr=0] +[is_orig=F, DF=T, ttl=63, size=60, win_size=28960, win_scale=7, MSS=1460, SACK_OK=F, TSval=532122365, TSecr=602505000] diff --git a/testing/btest/Baseline/scripts.policy.misc.dump-events/really-all-events.log b/testing/btest/Baseline/scripts.policy.misc.dump-events/really-all-events.log index 1c1d928b1c..3836b0306c 100644 --- a/testing/btest/Baseline/scripts.policy.misc.dump-events/really-all-events.log +++ b/testing/btest/Baseline/scripts.policy.misc.dump-events/really-all-events.log @@ -114,7 +114,7 @@ XXXXXXXXXX.XXXXXX new_packet XXXXXXXXXX.XXXXXX connection_SYN_packet [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=128, size=48, win_size=65535, win_scale=-1, MSS=1460, SACK_OK=T] + [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=128, size=48, win_size=65535, win_scale=-1, MSS=1460, SACK_OK=T, TSval=, TSecr=] XXXXXXXXXX.XXXXXX tcp_packet [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] @@ -165,7 +165,7 @@ XXXXXXXXXX.XXXXXX new_packet XXXXXXXXXX.XXXXXX connection_SYN_packet [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=50, size=48, win_size=5840, win_scale=-1, MSS=1460, SACK_OK=T] + [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=50, size=48, win_size=5840, win_scale=-1, MSS=1460, SACK_OK=T, TSval=, TSecr=] XXXXXXXXXX.XXXXXX connection_established [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] @@ -6409,7 +6409,7 @@ XXXXXXXXXX.XXXXXX new_packet XXXXXXXXXX.XXXXXX connection_SYN_packet [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=64, size=64, win_size=65535, win_scale=5, MSS=1460, SACK_OK=T] + [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=64, size=64, win_size=65535, win_scale=5, MSS=1460, SACK_OK=T, TSval=403034601, TSecr=0] XXXXXXXXXX.XXXXXX tcp_packet [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] @@ -6484,7 +6484,7 @@ XXXXXXXXXX.XXXXXX new_packet XXXXXXXXXX.XXXXXX connection_SYN_packet [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=64, size=60, win_size=28960, win_scale=7, MSS=1460, SACK_OK=T] + [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=64, size=60, win_size=28960, win_scale=7, MSS=1460, SACK_OK=T, TSval=84163, TSecr=403034601] XXXXXXXXXX.XXXXXX connection_established [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] @@ -8441,7 +8441,7 @@ XXXXXXXXXX.XXXXXX new_packet XXXXXXXXXX.XXXXXX connection_SYN_packet [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=64, size=64, win_size=65535, win_scale=5, MSS=1460, SACK_OK=T] + [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=64, size=64, win_size=65535, win_scale=5, MSS=1460, SACK_OK=T, TSval=403046199, TSecr=0] XXXXXXXXXX.XXXXXX tcp_packet [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] @@ -8517,7 +8517,7 @@ XXXXXXXXXX.XXXXXX new_packet XXXXXXXXXX.XXXXXX connection_SYN_packet [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=242, size=52, win_size=8190, win_scale=4, MSS=1440, SACK_OK=T] + [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=242, size=52, win_size=8190, win_scale=4, MSS=1440, SACK_OK=T, TSval=, TSecr=] XXXXXXXXXX.XXXXXX connection_established [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] diff --git a/testing/btest/Traces/tcp/timestamp.pcap b/testing/btest/Traces/tcp/timestamp.pcap new file mode 100644 index 0000000000..2447f20cd2 Binary files /dev/null and b/testing/btest/Traces/tcp/timestamp.pcap differ diff --git a/testing/btest/scripts/base/protocols/tcp/timestamp.zeek b/testing/btest/scripts/base/protocols/tcp/timestamp.zeek new file mode 100644 index 0000000000..cf3b899907 --- /dev/null +++ b/testing/btest/scripts/base/protocols/tcp/timestamp.zeek @@ -0,0 +1,6 @@ +# @TEST-EXEC: zeek -b -C -r $TRACES/tcp/timestamp.pcap %INPUT +# @TEST-EXEC: btest-diff .stdout + +event connection_SYN_packet(c: connection, pkt: SYN_packet) { + print pkt; +}