diff --git a/scripts/base/protocols/mqtt/main.zeek b/scripts/base/protocols/mqtt/main.zeek index f29e2968d3..49df03c54e 100644 --- a/scripts/base/protocols/mqtt/main.zeek +++ b/scripts/base/protocols/mqtt/main.zeek @@ -50,10 +50,10 @@ export { ## Indicates if a subscribe or unsubscribe action is taking place action: SubUnsub &log; - ## The topic (or topic pattern) being subscribed to - topic: string &log; - ## QoS level requested for messages from subscribed topics - qos_level: count &log &optional; + ## The topics (or topic patterns) being subscribed to + topics: string_vec &log; + ## QoS levels requested for messages from subscribed topics + qos_levels: index_vec &log &optional; ## QoS level the server granted granted_qos_level: count &log &optional; ## Indicates if the request was acked by the server @@ -284,7 +284,7 @@ event mqtt_pubcomp(c: connection, is_orig: bool, msg_id: count) &priority=-5 } -event mqtt_subscribe(c: connection, msg_id: count, topic: string, requested_qos: count) &priority=5 +event mqtt_subscribe(c: connection, msg_id: count, topics: string_vec, requested_qos: index_vec) &priority=5 { local info = set_session(c); @@ -292,8 +292,8 @@ event mqtt_subscribe(c: connection, msg_id: count, topic: string, requested_qos: $uid = c$uid, $id = c$id, $action = MQTT::SUBSCRIBE, - $topic = topic, - $qos_level = requested_qos); + $topics = topics, + $qos_levels = requested_qos); c$mqtt_state$subscribe[msg_id] = si; } @@ -313,7 +313,7 @@ event mqtt_suback(c: connection, msg_id: count, granted_qos: count) &priority=5 delete c$mqtt_state$subscribe[msg_id]; } -event mqtt_unsubscribe(c: connection, msg_id: count, topic: string) &priority=5 +event mqtt_unsubscribe(c: connection, msg_id: count, topics: string_vec) &priority=5 { set_session(c); @@ -321,7 +321,7 @@ event mqtt_unsubscribe(c: connection, msg_id: count, topic: string) &priority=5 $uid = c$uid, $id = c$id, $action = MQTT::UNSUBSCRIBE, - $topic = topic); + $topics = topics); c$mqtt_state$subscribe[msg_id] = si; } diff --git a/src/analyzer/protocol/mqtt/commands/subscribe.pac b/src/analyzer/protocol/mqtt/commands/subscribe.pac index cf001f960b..24c2810dfe 100644 --- a/src/analyzer/protocol/mqtt/commands/subscribe.pac +++ b/src/analyzer/protocol/mqtt/commands/subscribe.pac @@ -19,17 +19,23 @@ refine flow MQTT_Flow += { %{ if ( mqtt_subscribe ) { + auto topics = new VectorVal(string_vec); + auto qos_levels = new VectorVal(index_vec); + for (auto topic: *${msg.topics}) { auto subscribe_topic = new StringVal(${topic.name.str}.length(), reinterpret_cast(${topic.name.str}.begin())); - - BifEvent::generate_mqtt_subscribe(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - ${msg.msg_id}, - subscribe_topic, - ${topic.requested_QoS}); + auto qos = val_mgr->GetCount(${topic.requested_QoS}); + topics->Assign(topics->Size(), subscribe_topic); + qos_levels->Assign(qos_levels->Size(), qos); } + + BifEvent::generate_mqtt_subscribe(connection()->bro_analyzer(), + connection()->bro_analyzer()->Conn(), + ${msg.msg_id}, + topics, + qos_levels); } return true; diff --git a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac index c74bffc14d..a839e7e4af 100644 --- a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac +++ b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac @@ -14,16 +14,19 @@ refine flow MQTT_Flow += { %{ if ( mqtt_unsubscribe ) { + auto topics = new VectorVal(string_vec); + for (auto topic: *${msg.topics}) { auto unsubscribe_topic = new StringVal(${topic.str}.length(), reinterpret_cast(${topic.str}.begin())); - - BifEvent::generate_mqtt_unsubscribe(connection()->bro_analyzer(), - connection()->bro_analyzer()->Conn(), - ${msg.msg_id}, - unsubscribe_topic); + topics->Assign(topics->Size(), unsubscribe_topic); } + + BifEvent::generate_mqtt_unsubscribe(connection()->bro_analyzer(), + connection()->bro_analyzer()->Conn(), + ${msg.msg_id}, + topics); } return true; diff --git a/src/analyzer/protocol/mqtt/events.bif b/src/analyzer/protocol/mqtt/events.bif index b079e1afc5..ee2e22a761 100644 --- a/src/analyzer/protocol/mqtt/events.bif +++ b/src/analyzer/protocol/mqtt/events.bif @@ -64,7 +64,11 @@ event mqtt_pubcomp%(c: connection, is_orig: bool, msg_id: count%); ## is_orig: Direction in which the message was sent ## ## msg_id: The id value for the message. -event mqtt_subscribe%(c: connection, msg_id: count, topic: string, requested_qos: count%); +## +## topics: The topics being subscribed to +## +## requested_qos: The desired QoS option associated with each topic. +event mqtt_subscribe%(c: connection, msg_id: count, topics: string_vec, requested_qos: index_vec%); ## Generated for MQTT subscribe messages ## @@ -81,8 +85,8 @@ event mqtt_suback%(c: connection, msg_id: count, granted_qos: count%); ## ## msg_id: The id value for the message. ## -## topic: The topic being unsubscribed from -event mqtt_unsubscribe%(c: connection, msg_id: count, topic: string%); +## topics: The topics being unsubscribed from +event mqtt_unsubscribe%(c: connection, msg_id: count, topics: string_vec%); ## Generated for MQTT unsubscribe acknowledgements sent by the server ## diff --git a/testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_subscribe.log b/testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_subscribe.log index 8fa637a072..4c678e266c 100644 --- a/testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_subscribe.log +++ b/testing/btest/Baseline/scripts.base.protocols.mqtt.mqtt/mqtt_subscribe.log @@ -3,8 +3,8 @@ #empty_field (empty) #unset_field - #path mqtt_subscribe -#open 2019-07-29-16-44-12 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p action topic qos_level granted_qos_level ack -#types time string addr port addr port enum string count count bool +#open 2019-08-02-20-39-45 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p action topics qos_levels granted_qos_level ack +#types time string addr port addr port enum vector[string] vector[count] count bool 1461170590.745647 CHhAvVGS1DHFjwGM9 10.0.1.4 49327 198.41.30.241 1883 MQTT::SUBSCRIBE SampleTopic 0 0 T -#close 2019-07-29-16-44-12 +#close 2019-08-02-20-39-45