Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

tunnels: Add 'X' to history when reaching Tunnel::max_depth

Browse source
This commit is contained in:
Arne Welzel 2023-11-30 18:49:59 +01:00
parent ad9446d799
commit 7325bc945f
10 changed files with 51 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/protocols/conn/main.zeek
View file

@ -125,6 +125,7 @@ export {
## i inconsistent packet (e.g. FIN+RST bits set) ## i inconsistent packet (e.g. FIN+RST bits set)
## q multi-flag packet (SYN+FIN or SYN+RST bits set) ## q multi-flag packet (SYN+FIN or SYN+RST bits set)
## ^ connection direction was flipped by Zeek's heuristic ## ^ connection direction was flipped by Zeek's heuristic
## x connection analysis partial (e.g. limits exceeded)
## ====== ==================================================== ## ====== ====================================================
## ##
## If the event comes from the originator, the letter is in ## If the event comes from the originator, the letter is in

1
src/packet_analysis/protocol/ayiya/AYIYA.cc
View file

@ -20,6 +20,7 @@ bool AYIYAAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packe
return false; return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) { if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet); Weird("exceeded_tunnel_max_depth", packet);
return false; return false;
} }

1
src/packet_analysis/protocol/geneve/Geneve.cc
View file

@ -21,6 +21,7 @@ bool GeneveAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
return false; return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) { if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet); Weird("exceeded_tunnel_max_depth", packet);
return false; return false;
} }

1
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -23,6 +23,7 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
} }
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) { if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet); Weird("exceeded_tunnel_max_depth", packet);
return false; return false;
} }

1
src/packet_analysis/protocol/teredo/Teredo.cc
View file

@ -148,6 +148,7 @@ bool TeredoAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
return false; return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) { if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Analyzer::Weird("exceeded_tunnel_max_depth", packet); Analyzer::Weird("exceeded_tunnel_max_depth", packet);
return false; return false;
} }

1
src/packet_analysis/protocol/vxlan/VXLAN.cc
View file

@ -21,6 +21,7 @@ bool VXLAN_Analyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
return false; return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) { if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet); Weird("exceeded_tunnel_max_depth", packet);
return false; return false;
} }

5
testing/btest/Baseline/core.tunnels.max-depth-exceeded/conn.log.cut Normal file
View file

@ -0,0 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
uid id.orig_h id.resp_p id.resp_h id.resp_p proto history service tunnel_parents
CHhAvVGS1DHFjwGM9 1.1.1.1 4789 1.1.1.9 4789 udp D vxlan -
ClEkJM2Vm5giqnMf4h 2.2.2.2 4789 2.2.2.9 4789 udp D vxlan CHhAvVGS1DHFjwGM9
C4J4Th3PJpwUYZZ6gc 3.3.3.3 4789 3.3.3.9 4789 udp DX - ClEkJM2Vm5giqnMf4h

14
testing/btest/Baseline/core.tunnels.max-depth-exceeded/tunnel.log Normal file
View file

@ -0,0 +1,14 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path tunnel
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.1.1.1 4789 1.1.1.9 4789 Tunnel::VXLAN Tunnel::DISCOVER
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 2.2.2.2 4789 2.2.2.9 4789 Tunnel::VXLAN Tunnel::DISCOVER
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.1.1.1 4789 1.1.1.9 4789 Tunnel::VXLAN Tunnel::CLOSE
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 2.2.2.2 4789 2.2.2.9 4789 Tunnel::VXLAN Tunnel::CLOSE
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/core.tunnels.max-depth-exceeded/weird.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX - 3.3.3.3 0 3.3.3.9 0 exceeded_tunnel_max_depth_in_tunnel - F zeek VXLAN
#close XXXX-XX-XX-XX-XX-XX

15
testing/btest/core/tunnels/max-depth-exceeded.zeek Normal file
View file

@ -0,0 +1,15 @@
# @TEST-DOC: Set a too small Tunnel::max_depth value, observe the effects.
#
# @TEST-EXEC: zeek -b -r $TRACES/tunnels/vxlan-triple-v2.pcap %INPUT
# @TEST-EXEC: zeek-cut -m uid id.orig_h id.resp_p id.resp_h id.resp_p proto history service tunnel_parents < conn.log > conn.log.cut
# @TEST-EXEC: btest-diff conn.log.cut
# @TEST-EXEC: btest-diff tunnel.log
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: test ! -f dns.log
#
@load base/frameworks/notice/weird
@load base/frameworks/tunnels
@load base/protocols/conn
@load base/protocols/dns
redef Tunnel::max_depth = 2;