Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

add extended mac field with 20 byte digest (+4 byte key id)

Browse source
This commit is contained in:
Mauro Palumbo 2019-06-09 20:21:56 +02:00
parent 01ae5203e3
commit d0465bc45d
2 changed files with 16 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/analyzer/protocol/ntp/ntp-protocol.pac
View file

@ -40,13 +40,14 @@ type NTP_std_msg = record {
receive_ts : NTP_Time;
transmit_ts : NTP_Time;
#extensions : Extension_Field[] &until($input.length() == 20); #TODO: this need to be properly parsed
mac_fields : case (has_mac) of {
true -> mac : NTP_MAC;
mac_fields : case (mac_len) of {
20 -> mac : NTP_MAC;
24 -> mac_ext : NTP_MAC_ext;
false -> nil : empty;
} &requires(has_mac);
} &requires(mac_len);
} &let {
length = sourcedata.length();
has_mac: bool = (length - offsetof(mac_fields)) == 20;
mac_len: uint32 = (length - offsetof(mac_fields));
} &byteorder=bigendian &exportsourcedata;
# This format is for mode==6, control msg
@ -78,6 +79,12 @@ type NTP_MAC = record {
digest: bytestring &length=16;
} &length=20;
# As in RFC 5906, same as NTP_MAC but with a 160 bit digest
type NTP_MAC_ext = record {
key_id: uint32;
digest: bytestring &length=20;
} &length=24;
# As in RFC 1119
type NTP_CONTROL_MAC = record {
key_id: uint32;