Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add success indicator to the ntlm.log.

Browse source 
This changes the single gssapi event slightly too.
This commit is contained in:
Seth Hall 2016-04-13 12:09:05 -04:00
parent b4b9fbb8d2
commit 5d33ac773b
4 changed files with 55 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

35
scripts/base/protocols/ntlm/main.bro
View file

@ -14,6 +14,13 @@ export {
username: string &log &optional;
hostname: string &log &optional;
domainname: string &log &optional;
## Indicate whether or not the authentication was successful.
success: bool &log &default=F;
## Internally used field to indicate if the login attempt
## has already been logged.
done: bool &default=F;
};
}
@ -28,13 +35,10 @@ event bro_init() &priority=5
event ntlm_negotiate(c: connection, request: NTLM::Negotiate) &priority=5
{
#print request;
}
event ntlm_challenge(c: connection, challenge: NTLM::Challenge) &priority=5
{
#print "challenge!!!!!";
#print challenge;
}
event ntlm_authenticate(c: connection, request: NTLM::Authenticate) &priority=5
@ -48,7 +52,28 @@ event ntlm_authenticate(c: connection, request: NTLM::Authenticate) &priority=5
c$ntlm$username = request$user_name;
}
event ntlm_authenticate(c: connection, request: NTLM::Authenticate) &priority=-5
event gssapi_neg_result(c: connection, state: count) &priority=5
{
Log::write(NTLM::LOG, c$ntlm);
if ( c?$ntlm )
c$ntlm$success = (state == 0);
}
event gssapi_neg_result(c: connection, state: count) &priority=-5
{
if ( c?$ntlm )
{
if ( c$ntlm?$username || c$ntlm?$hostname )
{
Log::write(NTLM::LOG, c$ntlm);
c$ntlm$done = T;
}
}
}
event connection_state_remove(c: connection) &priority=-5
{
if ( c?$ntlm && ! c$ntlm$done )
{
Log::write(NTLM::LOG, c$ntlm);
}
}