Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adding extra fields to smtp and http to track transaction depth.

Browse source 
- This will for help linking in analysis scripts and databases later.

- Test baseline updates coming in a few minutes.
This commit is contained in:
Seth Hall 2011-10-25 11:34:48 -04:00
parent 2131468b08
commit 4753f2aeca
3 changed files with 18 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/protocols/http/main.bro
View file

@ -18,6 +18,9 @@ export {
ts: time &log; ts: time &log;
uid: string &log; uid: string &log;
id: conn_id &log; id: conn_id &log;
## This represents the pipelined depth into the connection of this
## request/response transaction.
trans_depth: count &log;
## The verb used in the HTTP request (GET, POST, HEAD, etc.). ## The verb used in the HTTP request (GET, POST, HEAD, etc.).
method: string &log &optional; method: string &log &optional;
## The value of the HOST header. ## The value of the HOST header.
@ -123,6 +126,9 @@ function new_http_session(c: connection): Info
tmp$ts=network_time(); tmp$ts=network_time();
tmp$uid=c$uid; tmp$uid=c$uid;
tmp$id=c$id; tmp$id=c$id;
# $current_request is set prior to the Info record creation so we
# can use the value directly here.
tmp$trans_depth = c$http_state$current_request;
return tmp; return tmp;
} }

8
scripts/base/protocols/smtp/entities.bro
View file

@ -19,9 +19,9 @@ export {
ts: time &log; ts: time &log;
uid: string &log; uid: string &log;
id: conn_id &log; id: conn_id &log;
## Internally generated "message id" that ties back to the particular ## A count to represent the depth of this message transaction in a
## message in the SMTP log where this entity was seen. ## single connection where multiple messages were transferred.
mid: string &log; trans_depth: count &log;
## The filename seen in the Content-Disposition header. ## The filename seen in the Content-Disposition header.
filename: string &log &optional; filename: string &log &optional;
## Track how many bytes of the MIME encoded file have been seen. ## Track how many bytes of the MIME encoded file have been seen.
@ -90,7 +90,7 @@ function set_session(c: connection, new_entity: bool)
info$ts=network_time(); info$ts=network_time();
info$uid=c$uid; info$uid=c$uid;
info$id=c$id; info$id=c$id;
info$mid=c$smtp$mid; info$trans_depth=c$smtp$trans_depth;
c$smtp$current_entity = info; c$smtp$current_entity = info;
++c$smtp_state$mime_level; ++c$smtp_state$mime_level;

15
scripts/base/protocols/smtp/main.bro
View file

@ -11,10 +11,9 @@ export {
ts: time &log; ts: time &log;
uid: string &log; uid: string &log;
id: conn_id &log; id: conn_id &log;
## This is an internally generated "message id" that can be used to ## This is a number that indicates the number of messages deep into
## map between SMTP messages and MIME entities in the SMTP entities ## this connection where this particular message was transferred.
## log. trans_depth: count &log;
mid: string &log;
helo: string &log &optional; helo: string &log &optional;
mailfrom: string &log &optional; mailfrom: string &log &optional;
rcptto: set[string] &log &optional; rcptto: set[string] &log &optional;
@ -98,8 +97,11 @@ function new_smtp_log(c: connection): Info
l$ts=network_time(); l$ts=network_time();
l$uid=c$uid; l$uid=c$uid;
l$id=c$id; l$id=c$id;
l$mid=unique_id("@"); # The messages_transferred count isn't incremented until the message is
if ( c?$smtp_state && c$smtp_state?$helo ) # finished so we need to increment the count by 1 here.
l$trans_depth = c$smtp_state$messages_transferred+1;
if ( c$smtp_state?$helo )
l$helo = c$smtp_state$helo; l$helo = c$smtp_state$helo;
# The path will always end with the hosts involved in this connection. # The path will always end with the hosts involved in this connection.
@ -165,7 +167,6 @@ event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string, event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
msg: string, cont_resp: bool) &priority=-5 msg: string, cont_resp: bool) &priority=-5
{ {
set_smtp_session(c);
if ( cmd == "." ) if ( cmd == "." )
{ {
# Track the number of messages seen in this session. # Track the number of messages seen in this session.