Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/jsiwek/geoip-fixes'

Browse source 
* origin/topic/jsiwek/geoip-fixes:
  Fixes for GeoIP support (addresses #538).
This commit is contained in:
Seth Hall 2011-08-31 10:29:39 -04:00
commit c67c1e8ba6
5 changed files with 99 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/policy/protocols/smtp/detect-suspicious-orig.bro
View file

@ -25,11 +25,13 @@ event log_smtp(rec: Info)
ip = rec$x_originating_ip;
loc = lookup_location(ip);
if ( loc$country_code in suspicious_origination_countries ||
if ( (loc?$country_code &&
loc$country_code in suspicious_origination_countries) ||
ip in suspicious_origination_networks )
{
NOTICE([$note=Suspicious_Origination,
$msg=fmt("An email originated from %s (%s).", loc$country_code, ip),
$msg=fmt("An email originated from %s (%s).",
loc?$country_code ? loc$country_code : "", ip),
$id=rec$id]);
}
}
@ -38,11 +40,12 @@ event log_smtp(rec: Info)
ip = rec$path[|rec$path|-1];
loc = lookup_location(ip);
if ( loc$country_code in suspicious_origination_countries ||
if ( (loc?$country_code &&
loc$country_code in suspicious_origination_countries) ||
ip in suspicious_origination_networks )
{
NOTICE([$note=Suspicious_Origination,
$msg=fmt("Based up Received headers, email originated from %s (%s).", loc$country_code, ip),
$msg=fmt("Based up Received headers, email originated from %s (%s).", loc?$country_code ? loc$country_code : "", ip),
$id=rec$id]);
}
}

2
scripts/policy/protocols/ssh/geo-data.bro
View file

@ -33,7 +33,7 @@ event SSH::heuristic_successful_login(c: connection) &priority=5
# Add the location data to the SSH record.
c$ssh$remote_location = location;
if ( location$country_code in watched_countries )
if ( location?$country_code && location$country_code in watched_countries )
{
NOTICE([$note=Login_From_Watched_Country,
$conn=c,