Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-999: Stop formatting DHCP Client ID Hardware Type 0 as MAC

Browse source 
For `DHCP::ClientID$hwtype` fields equal to 0, the `hwaddr` field is
no longer misformatted as a MAC and instead just contains the raw bytes
seen in the DHCP Client ID Option.
This commit is contained in:
Jon Siwek 2020-06-04 10:26:23 -07:00
parent 02476453bc
commit 96f7226b52
4 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/analyzer/protocol/dhcp/dhcp-options.pac
View file

@ -627,7 +627,16 @@ refine flow DHCP_Flow += {
%{
auto client_id = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientID);
client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype}));
client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())));
IntrusivePtr<StringVal> sv;
if ( ${v.client_id.hwtype} == 0 )
sv = make_intrusive<StringVal>(${v.client_id.hwaddr}.length(),
(const char*)${v.client_id.hwaddr}.begin());
else
sv = make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(),
${v.client_id.hwaddr}.length()));
client_id->Assign(1, std::move(sv));
${context.flow}->options->Assign(19, std::move(client_id));

1
testing/btest/Baseline/scripts.base.protocols.dhcp.hw-type0/out Normal file
View file

@ -0,0 +1 @@
dhcp client_id option, [hwtype=0, hwaddr=cisco-cc00.0ac4.0000-Fa0/0]

BIN
testing/btest/Traces/dhcp/hw-type0.pcap Normal file
View file

Binary file not shown.

16
testing/btest/scripts/base/protocols/dhcp/hw-type0.zeek Normal file
View file

@ -0,0 +1,16 @@
# @TEST-EXEC: zeek -b -r $TRACES/dhcp/hw-type0.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
const ports = { 67/udp, 68/udp };
redef likely_server_ports += { 67/udp };
event zeek_init() &priority=5
{
Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports);
}
event dhcp_message(c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options)
{
if ( options?$client_id )
print "dhcp client_id option", options$client_id;
}