Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adding client_security_data to the analyzer.

Browse source
This commit is contained in:
jatkinosn 2019-06-06 09:49:24 -04:00
parent d3927d9266
commit b6746bc9e0
4 changed files with 35 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/analyzer/protocol/rdp/events.bif
View file

@ -26,6 +26,13 @@ event rdp_negotiation_failure%(c: connection, failure_code: count%);
## data: The data contained in the client core data structure. ## data: The data contained in the client core data structure.
event rdp_client_core_data%(c: connection, data: RDP::ClientCoreData%); event rdp_client_core_data%(c: connection, data: RDP::ClientCoreData%);
## Generated for client security data packets.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## data: The data contained in the client security data structure.
event rdp_client_security_data%(c: connection, data: RDP::ClientSecurityData%);
## Generated for Client Network Data (TS_UD_CS_NET) packets ## Generated for Client Network Data (TS_UD_CS_NET) packets
## ##
## c: The connection record for the underlying transport-layer session/flow. ## c: The connection record for the underlying transport-layer session/flow.

18
src/analyzer/protocol/rdp/rdp-analyzer.pac
View file

@ -101,6 +101,20 @@ refine flow RDP_Flow += {
return true; return true;
%} %}
function proc_rdp_client_security_data(csec: Client_Security_Data): bool
%{
if ( ! rdp_client_security_data )
return false;
RecordVal* csd = new RecordVal(BifType::Record::RDP::ClientSecurityData);
csd->Assign(0, val_mgr->GetCount(${csec.encryption_methods}));
csd->Assign(1, val_mgr->GetCount(${csec.ext_encryption_methods}));
BifEvent::generate_rdp_client_security_data(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
csd);
%}
function proc_rdp_client_network_data(cnetwork: Client_Network_Data): bool function proc_rdp_client_network_data(cnetwork: Client_Network_Data): bool
%{ %{
if ( ! rdp_client_network_data ) if ( ! rdp_client_network_data )
@ -203,6 +217,10 @@ refine typeattr Client_Core_Data += &let {
proc: bool = $context.flow.proc_rdp_client_core_data(this); proc: bool = $context.flow.proc_rdp_client_core_data(this);
}; };
refine typeattr Client_Security_Data += &let {
proc: bool = $context.flow.proc_rdp_client_security_data(this);
};
refine typeattr Client_Network_Data += &let { refine typeattr Client_Network_Data += &let {
proc: bool = $context.flow.proc_rdp_client_network_data(this); proc: bool = $context.flow.proc_rdp_client_network_data(this);
}; };

7
src/analyzer/protocol/rdp/rdp-protocol.pac
View file

@ -52,7 +52,7 @@ type Data_Block = record {
header: Data_Header; header: Data_Header;
block: case header.type of { block: case header.type of {
0xc001 -> client_core: Client_Core_Data; 0xc001 -> client_core: Client_Core_Data;
#0xc002 -> client_security: Client_Security_Data; 0xc002 -> client_security: Client_Security_Data;
0xc003 -> client_network: Client_Network_Data; 0xc003 -> client_network: Client_Network_Data;
#0xc004 -> client_cluster: Client_Cluster_Data; #0xc004 -> client_cluster: Client_Cluster_Data;
#0xc005 -> client_monitor: Client_Monitor_Data; #0xc005 -> client_monitor: Client_Monitor_Data;
@ -220,6 +220,11 @@ type Client_Core_Data = record {
SUPPORT_HEARTBEAT_PDU: bool = early_capability_flags & 0x0400; SUPPORT_HEARTBEAT_PDU: bool = early_capability_flags & 0x0400;
} &byteorder=littleendian; } &byteorder=littleendian;
type Client_Security_Data = record {
encryption_methods: uint16;
ext_encryption_methods: uint16;
} &byteorder=littleendian;
type Client_Network_Data = record { type Client_Network_Data = record {
channel_count: uint32; channel_count: uint32;
channel_def_array: Client_Channel_Def[channel_count]; channel_def_array: Client_Channel_Def[channel_count];

5
src/analyzer/protocol/rdp/types.bif
View file

@ -4,5 +4,8 @@ module RDP;
type EarlyCapabilityFlags: record; type EarlyCapabilityFlags: record;
type ClientCoreData: record; type ClientCoreData: record;
# JSA
type ClientSecurityData: record;
type ClientChannelList: vector; type ClientChannelList: vector;
type ClientChannelDef: record; type ClientChannelDef: record;