Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-209: replace "remote_ip" field of radius.log with "tunnel_client"

Browse source 
The type of the field also changed from "addr" to "string" because the
former cannot represent all possible values of the
Tunnel-Client-Endpoint attribute, which may include FQDNs, not just IP
addresses.
This commit is contained in:
Jon Siwek 2019-06-05 11:11:49 -07:00
parent 80fe3d5583
commit ed113918e7
4 changed files with 19 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

5
NEWS
View file

@ -216,6 +216,11 @@ Changed Functionality
in scripts has also been updated to replace Sphinx cross-referencing roles in scripts has also been updated to replace Sphinx cross-referencing roles
and directives like ":bro:see:" with ":zeek:zee:". and directives like ":bro:see:" with ":zeek:zee:".
- The "remote_ip" field of "addr" type was removed from radius.log and
replaced with a field named "tunnel_client" of "string" type. The
reason for this is that the Tunnel-Client-Endpoint RADIUS attribute
this data is derived from may also be a FQDN, not just an IP address.
Removed Functionality Removed Functionality
--------------------- ---------------------

11
scripts/base/protocols/radius/main.zeek
View file

@ -24,9 +24,10 @@ export {
## and the network access server is not required to honor ## and the network access server is not required to honor
## the address. ## the address.
framed_addr : addr &log &optional; framed_addr : addr &log &optional;
## Remote IP address, if present. This is collected ## Address (IPv4, IPv6, or FQDN) of the initiator end of the tunnel,
## from the Tunnel-Client-Endpoint attribute. ## if present. This is collected from the Tunnel-Client-Endpoint
remote_ip : addr &log &optional; ## attribute.
tunnel_client: string &log &optional;
## Connect info, if present. ## Connect info, if present.
connect_info : string &log &optional; connect_info : string &log &optional;
## Reply message from the server challenge. This is ## Reply message from the server challenge. This is
@ -85,8 +86,8 @@ event radius_message(c: connection, result: RADIUS::Message) &priority=5
c$radius$mac = normalize_mac(result$attributes[31][0]); c$radius$mac = normalize_mac(result$attributes[31][0]);
# Tunnel-Client-EndPoint (useful for VPNs) # Tunnel-Client-EndPoint (useful for VPNs)
if ( ! c$radius?$remote_ip && 66 in result$attributes ) if ( ! c$radius?$tunnel_client && 66 in result$attributes )
c$radius$remote_ip = to_addr(result$attributes[66][0]); c$radius$tunnel_client = result$attributes[66][0];
# Connect-Info # Connect-Info
if ( ! c$radius?$connect_info && 77 in result$attributes ) if ( ! c$radius?$connect_info && 77 in result$attributes )

8
testing/btest/Baseline/scripts.base.protocols.radius.auth/radius.log
View file

@ -3,8 +3,8 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path radius #path radius
#open 2017-02-20-04-53-55 #open 2019-06-05-18-03-41
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr remote_ip connect_info reply_msg result ttl #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr tunnel_client connect_info reply_msg result ttl
#types time string addr port addr port string string addr addr string string string interval #types time string addr port addr port string string addr string string string string interval
1217631137.872968 CHhAvVGS1DHFjwGM9 10.0.0.1 1645 10.0.0.100 1812 John.McGuirk 00:14:22:e9:54:5e 255.255.255.254 - - Hello, %u success 0.043882 1217631137.872968 CHhAvVGS1DHFjwGM9 10.0.0.1 1645 10.0.0.100 1812 John.McGuirk 00:14:22:e9:54:5e 255.255.255.254 - - Hello, %u success 0.043882
#close 2017-02-20-04-53-55 #close 2019-06-05-18-03-41

8
testing/btest/Baseline/scripts.base.protocols.radius.radius-multiple-attempts/radius.log
View file

@ -3,9 +3,9 @@
#empty_field (empty) #empty_field (empty)
#unset_field - #unset_field -
#path radius #path radius
#open 2017-02-20-04-56-31 #open 2019-06-05-18-04-34
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr remote_ip connect_info reply_msg result ttl #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p username mac framed_addr tunnel_client connect_info reply_msg result ttl
#types time string addr port addr port string string addr addr string string string interval #types time string addr port addr port string string addr string string string string interval
1440447766.440305 CHhAvVGS1DHFjwGM9 127.0.0.1 53031 127.0.0.1 1812 steve - 172.16.3.33 - - - failed 1.005906 1440447766.440305 CHhAvVGS1DHFjwGM9 127.0.0.1 53031 127.0.0.1 1812 steve - 172.16.3.33 - - - failed 1.005906
1440447839.947454 ClEkJM2Vm5giqnMf4h 127.0.0.1 65443 127.0.0.1 1812 steve - 172.16.3.33 - - - success 0.000779 1440447839.947454 ClEkJM2Vm5giqnMf4h 127.0.0.1 65443 127.0.0.1 1812 steve - 172.16.3.33 - - - success 0.000779
1440447848.196115 C4J4Th3PJpwUYZZ6gc 127.0.0.1 57717 127.0.0.1 1812 steve - - - - - success 0.000275 1440447848.196115 C4J4Th3PJpwUYZZ6gc 127.0.0.1 57717 127.0.0.1 1812 steve - - - - - success 0.000275
@ -13,4 +13,4 @@
1440447880.931272 CUM0KZ3MLUfNB0cl11 127.0.0.1 52178 127.0.0.1 1812 steve - - - - - failed 1.001459 1440447880.931272 CUM0KZ3MLUfNB0cl11 127.0.0.1 52178 127.0.0.1 1812 steve - - - - - failed 1.001459
1440447904.122012 CmES5u32sYpV7JYN 127.0.0.1 62956 127.0.0.1 1812 steve - - - - - unknown - 1440447904.122012 CmES5u32sYpV7JYN 127.0.0.1 62956 127.0.0.1 1812 steve - - - - - unknown -
1440448190.335333 CP5puj4I8PtEU4qzYg 127.0.0.1 53127 127.0.0.1 1812 steve - - - - - success 0.000517 1440448190.335333 CP5puj4I8PtEU4qzYg 127.0.0.1 53127 127.0.0.1 1812 steve - - - - - success 0.000517
#close 2017-02-20-04-56-31 #close 2019-06-05-18-04-34