Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

A small fix to ssh/geo-data.bro. ssh can now be unset for local-local or remote-remote, so make the script deal with this.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-04-29 20:57:40 -04:00
parent 1508b00489
commit cb91a9c101
2 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/ssh/main.bro
View file

@ -118,7 +118,7 @@ event ssh_client_version(c: connection, version: string)
c$ssh$version = 2; c$ssh$version = 2;
} }
event ssh_auth_successful(c: connection, auth_method_none: bool) event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=5
{ {
# TODO - what to do here? # TODO - what to do here?
if ( !c?$ssh || ( c$ssh?$auth_success && c$ssh$auth_success ) ) if ( !c?$ssh || ( c$ssh?$auth_success && c$ssh$auth_success ) )
@ -146,7 +146,7 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=-5
} }
} }
event ssh_auth_failed(c: connection) event ssh_auth_failed(c: connection) &priority=5
{ {
if ( !c?$ssh || ( c$ssh?$auth_success && !c$ssh$auth_success ) ) if ( !c?$ssh || ( c$ssh?$auth_success && !c$ssh$auth_success ) )
return; return;

6
scripts/policy/protocols/ssh/geo-data.bro
View file

@ -32,6 +32,9 @@ function get_location(c: connection): geo_location
event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3 event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3
{ {
if ( ! c$ssh?$direction )
return;
# Add the location data to the SSH record. # Add the location data to the SSH record.
c$ssh$remote_location = get_location(c); c$ssh$remote_location = get_location(c);
@ -47,6 +50,9 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3
event ssh_auth_failed(c: connection) &priority=3 event ssh_auth_failed(c: connection) &priority=3
{ {
if ( ! c$ssh?$direction )
return;
# Add the location data to the SSH record. # Add the location data to the SSH record.
c$ssh$remote_location = get_location(c); c$ssh$remote_location = get_location(c);
} }