diff --git a/CHANGES b/CHANGES index 8db89e1dc0..59168e0866 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,18 @@ +3.2.0-dev.360 | 2020-04-07 14:12:27 -0700 + + * Add "udp_content_ports" option + + Any port in that set found as either source or destination port + of a UDP packet will cause the "udp_contents" event to be raised. (Jon Siwek, Corelight) + + * Add new "udp_content_delivery_ports_use_resp" option + + This controls whether ports given by "udp_content_delivery_ports_orig" and + "udp_content_delivery_ports_orig" are in terms of the UDP packet's + destination port or by the Connection's "responder" port (the former is + the unchanged default behavior). (Jon Siwek, Corelight) + 3.2.0-dev.357 | 2020-04-07 13:43:38 -0700 * Fix connection duration thresholding diff --git a/NEWS b/NEWS index 34c42b7ca7..54931622ec 100644 --- a/NEWS +++ b/NEWS @@ -29,6 +29,14 @@ New Functionality detected, but also provides a few other events related to the RDPEUDP connection establishment. +- Add the ``udp_content_ports`` configuration option. Any port added to + this set will cause the ``udp_contents`` event to be raised. + +- Add the ``udp_content_delivery_ports_use_resp`` option which can be used + to specify how the destination port for the ``udp_content_delivery_ports_orig`` + and ``udp_content_delivery_ports_orig`` options is determined. The current value + keeps behavior as it was in previous versions of Zeek. + Changed Functionality --------------------- diff --git a/VERSION b/VERSION index 9280f6857e..58cb46f846 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.2.0-dev.357 +3.2.0-dev.360 diff --git a/doc b/doc index 26b923f841..9b976943a5 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit 26b923f841f98238f68756e91083bef7a3004b0c +Subproject commit 9b976943a56578b86762def2f10a1f33bd69079f diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 20db8ccfb6..0faa65d5c5 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -1116,6 +1116,7 @@ const tcp_content_deliver_all_resp = F &redef; ## tcp_content_deliver_all_orig tcp_content_deliver_all_resp ## udp_content_delivery_ports_resp udp_content_deliver_all_orig ## udp_content_deliver_all_resp udp_contents +## udp_content_delivery_ports_use_resp udp_content_ports const udp_content_delivery_ports_orig: table[port] of bool = {} &redef; ## Defines UDP destination ports for which the contents of the responder stream @@ -1125,8 +1126,26 @@ const udp_content_delivery_ports_orig: table[port] of bool = {} &redef; ## tcp_content_delivery_ports_resp tcp_content_deliver_all_orig ## tcp_content_deliver_all_resp udp_content_delivery_ports_orig ## udp_content_deliver_all_orig udp_content_deliver_all_resp udp_contents +## udp_content_delivery_ports_use_resp udp_content_ports const udp_content_delivery_ports_resp: table[port] of bool = {} &redef; +## Defines UDP ports (source or destination) for which the contents of +## either originator or responder streams should be delivered via +## :zeek:see:`udp_contents`. +## +## .. zeek:see:: tcp_content_delivery_ports_orig +## tcp_content_delivery_ports_resp tcp_content_deliver_all_orig +## tcp_content_deliver_all_resp udp_content_delivery_ports_orig +## udp_content_deliver_all_orig udp_content_deliver_all_resp udp_contents +## udp_content_delivery_ports_use_resp udp_content_delivery_ports_resp +option udp_content_ports: set[port] = {}; + +## Whether ports given in :zeek:see:`udp_content_delivery_ports_orig` +## and :zeek:see:`udp_content_delivery_ports_resp` are in terms of +## UDP packet's destination port or the UDP connection's "responder" +## port. +option udp_content_delivery_ports_use_resp = F; + ## If true, all UDP originator-side traffic is reported via ## :zeek:see:`udp_contents`. ## @@ -1135,6 +1154,7 @@ const udp_content_delivery_ports_resp: table[port] of bool = {} &redef; ## tcp_content_delivery_ports_orig udp_content_delivery_ports_orig ## udp_content_delivery_ports_resp udp_content_deliver_all_resp ## udp_contents +## udp_content_delivery_ports_use_resp const udp_content_deliver_all_orig = F &redef; ## If true, all UDP responder-side traffic is reported via @@ -1145,6 +1165,7 @@ const udp_content_deliver_all_orig = F &redef; ## tcp_content_delivery_ports_orig udp_content_delivery_ports_orig ## udp_content_delivery_ports_resp udp_content_deliver_all_orig ## udp_contents +## udp_content_delivery_ports_use_resp const udp_content_deliver_all_resp = F &redef; ## Check for expired table entries after this amount of time. diff --git a/src/NetVar.cc b/src/NetVar.cc index 53a5e6c35c..cb604c75ba 100644 --- a/src/NetVar.cc +++ b/src/NetVar.cc @@ -75,8 +75,10 @@ bool tcp_content_deliver_all_resp; TableVal* udp_content_delivery_ports_orig; TableVal* udp_content_delivery_ports_resp; +TableVal* udp_content_ports; bool udp_content_deliver_all_orig; bool udp_content_deliver_all_resp; +bool udp_content_delivery_ports_use_resp; double dns_session_timeout; double rpc_timeout; @@ -319,10 +321,14 @@ void init_net_var() internal_val("udp_content_delivery_ports_orig")->AsTableVal(); udp_content_delivery_ports_resp = internal_val("udp_content_delivery_ports_resp")->AsTableVal(); + udp_content_ports = + internal_val("udp_content_ports")->AsTableVal(); udp_content_deliver_all_orig = bool(internal_val("udp_content_deliver_all_orig")->AsBool()); udp_content_deliver_all_resp = bool(internal_val("udp_content_deliver_all_resp")->AsBool()); + udp_content_delivery_ports_use_resp = + bool(internal_val("udp_content_delivery_ports_use_resp")->AsBool()); dns_session_timeout = opt_internal_double("dns_session_timeout"); rpc_timeout = opt_internal_double("rpc_timeout"); diff --git a/src/NetVar.h b/src/NetVar.h index a02c742859..07b1b92f10 100644 --- a/src/NetVar.h +++ b/src/NetVar.h @@ -75,8 +75,10 @@ extern bool tcp_content_deliver_all_resp; extern TableVal* udp_content_delivery_ports_orig; extern TableVal* udp_content_delivery_ports_resp; +extern TableVal* udp_content_ports; extern bool udp_content_deliver_all_orig; extern bool udp_content_deliver_all_resp; +extern bool udp_content_delivery_ports_use_resp; extern double dns_session_timeout; extern double rpc_timeout; diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc index faaee88075..23f6f88188 100644 --- a/src/analyzer/protocol/udp/UDP.cc +++ b/src/analyzer/protocol/udp/UDP.cc @@ -134,22 +134,33 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, if ( udp_contents ) { - auto port_val = val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP); bool do_udp_contents = false; + auto sport_val = IntrusivePtr{AdoptRef{}, val_mgr->GetPort(ntohs(up->uh_sport), TRANSPORT_UDP)}; + auto dport_val = IntrusivePtr{AdoptRef{}, val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP)}; - if ( is_orig ) - { - auto result = udp_content_delivery_ports_orig->Lookup(port_val); - - if ( udp_content_deliver_all_orig || (result && result->AsBool()) ) - do_udp_contents = true; - } + if ( udp_content_ports->Lookup(dport_val.get()) || + udp_content_ports->Lookup(sport_val.get()) ) + do_udp_contents = true; else { - auto result = udp_content_delivery_ports_resp->Lookup(port_val); + uint16_t p = udp_content_delivery_ports_use_resp ? Conn()->RespPort() + : up->uh_dport; + auto port_val = IntrusivePtr{AdoptRef{}, val_mgr->GetPort(ntohs(p), TRANSPORT_UDP)}; - if ( udp_content_deliver_all_resp || (result && result->AsBool()) ) - do_udp_contents = true; + if ( is_orig ) + { + auto result = udp_content_delivery_ports_orig->Lookup(port_val.get()); + + if ( udp_content_deliver_all_orig || (result && result->AsBool()) ) + do_udp_contents = true; + } + else + { + auto result = udp_content_delivery_ports_resp->Lookup(port_val.get()); + + if ( udp_content_deliver_all_resp || (result && result->AsBool()) ) + do_udp_contents = true; + } } if ( do_udp_contents ) @@ -158,8 +169,6 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, make_intrusive(len, (const char*) data) ); - - Unref(port_val); } if ( is_orig ) diff --git a/testing/btest/Baseline/core.udp-content-ports/out b/testing/btest/Baseline/core.udp-content-ports/out new file mode 100644 index 0000000000..864009bd53 --- /dev/null +++ b/testing/btest/Baseline/core.udp-content-ports/out @@ -0,0 +1,2 @@ +Contents:, [orig_h=202.77.162.213, orig_p=54790/udp, resp_h=172.16.115.20, resp_p=111/udp], T, 56 +Contents:, [orig_h=202.77.162.213, orig_p=54790/udp, resp_h=172.16.115.20, resp_p=111/udp], F, 28 diff --git a/testing/btest/Baseline/core.udp-contents-delivery-ports-use-resp/out b/testing/btest/Baseline/core.udp-contents-delivery-ports-use-resp/out new file mode 100644 index 0000000000..611a684c9e --- /dev/null +++ b/testing/btest/Baseline/core.udp-contents-delivery-ports-use-resp/out @@ -0,0 +1,2 @@ +Contents:, [orig_h=172.16.115.20, orig_p=111/udp, resp_h=202.77.162.213, resp_p=54790/udp], F, 56 +Contents:, [orig_h=172.16.115.20, orig_p=111/udp, resp_h=202.77.162.213, resp_p=54790/udp], T, 28 diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 3bb2f44cec..af177cac00 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -282,7 +282,7 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Config::LOG)) -> @@ -463,7 +463,7 @@ 0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) -> 0.000000 MetaHookPost CallFunction(NetControl::init, , ()) -> 0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) -> @@ -547,6 +547,8 @@ 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(PacketFilter::build, , ()) -> 0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, , (ip or not ip, and, )) -> 0.000000 MetaHookPost CallFunction(PacketFilter::install, , ()) -> @@ -1198,7 +1200,7 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Config::LOG)) @@ -1379,7 +1381,7 @@ 0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(NetControl::check_plugins, , ()) 0.000000 MetaHookPre CallFunction(NetControl::init, , ()) 0.000000 MetaHookPre CallFunction(Notice::want_pp, , ()) @@ -1463,6 +1465,8 @@ 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(PacketFilter::build, , ()) 0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, , (ip or not ip, and, )) 0.000000 MetaHookPre CallFunction(PacketFilter::install, , ()) @@ -2113,7 +2117,7 @@ 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Config::LOG) @@ -2294,7 +2298,7 @@ 0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction NetControl::check_plugins() 0.000000 | HookCallFunction NetControl::init() 0.000000 | HookCallFunction Notice::want_pp() @@ -2378,6 +2382,8 @@ 0.000000 | HookCallFunction Option::set_change_handler(X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction PacketFilter::build() 0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, ) 0.000000 | HookCallFunction PacketFilter::install() @@ -2741,7 +2747,7 @@ 0.000000 | HookLoadFile base<...>/xmpp 0.000000 | HookLoadFile base<...>/zeek.bif.zeek 0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)} -0.000000 | HookLogWrite packet_filter [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T] +0.000000 | HookLogWrite packet_filter [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T] 0.000000 | HookQueueEvent NetControl::init() 0.000000 | HookQueueEvent filter_change_tracking() 0.000000 | HookQueueEvent zeek_init() diff --git a/testing/btest/core/udp-content-ports.zeek b/testing/btest/core/udp-content-ports.zeek new file mode 100644 index 0000000000..8679bf2f81 --- /dev/null +++ b/testing/btest/core/udp-content-ports.zeek @@ -0,0 +1,9 @@ +# @TEST-EXEC: zeek -b -r $TRACES/rpc-portmap-sadmind.pcap %INPUT >out +# @TEST-EXEC: btest-diff out + +redef udp_content_ports += { 54790/udp }; + +event udp_contents(c: connection, is_orig: bool, contents: string) + { + print "Contents:", c$id, is_orig, |contents|; + } diff --git a/testing/btest/core/udp-contents-delivery-ports-use-resp.zeek b/testing/btest/core/udp-contents-delivery-ports-use-resp.zeek new file mode 100644 index 0000000000..2091db1f2e --- /dev/null +++ b/testing/btest/core/udp-contents-delivery-ports-use-resp.zeek @@ -0,0 +1,12 @@ +# @TEST-EXEC: zeek -b -r $TRACES/rpc-portmap-sadmind.pcap %INPUT >out +# @TEST-EXEC: btest-diff out + +redef udp_content_delivery_ports_use_resp = T; +redef udp_content_delivery_ports_orig += {[54790/udp] = T}; +redef udp_content_delivery_ports_resp += {[54790/udp] = T}; +redef likely_server_ports += {54790/udp}; + +event udp_contents(c: connection, is_orig: bool, contents: string) + { + print "Contents:", c$id, is_orig, |contents|; + }