mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
Merge tag 'v2.3' into topic/vladg/sip
Version tag Conflicts: scripts/base/init-default.bro
This commit is contained in:
Vlad Grigorescu
commit
f93f2af748
283 changed files with 6843 additions and 3048 deletions
|
|
@ -183,7 +183,7 @@ function log_unmatched_msgs(msgs: PendingMessages)
|
|||
for ( trans_id in msgs )
|
||||
log_unmatched_msgs_queue(msgs[trans_id]);
|
||||
|
||||
msgs = PendingMessages();
|
||||
clear_table(msgs);
|
||||
}
|
||||
|
||||
function enqueue_new_msg(msgs: PendingMessages, id: count, msg: Info)
|
||||
|
|
@ -382,9 +382,19 @@ event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) &priori
|
|||
hook DNS::do_reply(c, msg, ans, fmt("%s", a));
|
||||
}
|
||||
|
||||
event dns_TXT_reply(c: connection, msg: dns_msg, ans: dns_answer, str: string) &priority=5
|
||||
event dns_TXT_reply(c: connection, msg: dns_msg, ans: dns_answer, strs: string_vec) &priority=5
|
||||
{
|
||||
hook DNS::do_reply(c, msg, ans, str);
|
||||
local txt_strings: string = "";
|
||||
|
||||
for ( i in strs )
|
||||
{
|
||||
if ( i > 0 )
|
||||
txt_strings += " ";
|
||||
|
||||
txt_strings += fmt("TXT %d %s", |strs[i]|, strs[i]);
|
||||
}
|
||||
|
||||
hook DNS::do_reply(c, msg, ans, txt_strings);
|
||||
}
|
||||
|
||||
event dns_AAAA_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) &priority=5
|
||||
|
|
|
|||
|
|
@ -76,7 +76,7 @@ event irc_dcc_message(c: connection, is_orig: bool,
|
|||
dcc_expected_transfers[address, p] = c$irc;
|
||||
}
|
||||
|
||||
event expected_connection_seen(c: connection, a: Analyzer::Tag) &priority=10
|
||||
event scheduled_analyzer_applied(c: connection, a: Analyzer::Tag) &priority=10
|
||||
{
|
||||
local id = c$id;
|
||||
if ( [id$resp_h, id$resp_p] in dcc_expected_transfers )
|
||||
|
|
|
|||
1
scripts/base/protocols/radius/__load__.bro
Normal file
1
scripts/base/protocols/radius/__load__.bro
Normal file
|
|
@ -0,0 +1 @@
|
|||
@load ./main
|
||||
231
scripts/base/protocols/radius/consts.bro
Normal file
231
scripts/base/protocols/radius/consts.bro
Normal file
|
|
@ -0,0 +1,231 @@
|
|||
|
||||
module RADIUS;
|
||||
|
||||
const msg_types: table[count] of string = {
|
||||
[1] = "Access-Request",
|
||||
[2] = "Access-Accept",
|
||||
[3] = "Access-Reject",
|
||||
[4] = "Accounting-Request",
|
||||
[5] = "Accounting-Response",
|
||||
[11] = "Access-Challenge",
|
||||
[12] = "Status-Server",
|
||||
[13] = "Status-Client",
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
|
||||
const attr_types: table[count] of string = {
|
||||
[1] = "User-Name",
|
||||
[2] = "User-Password",
|
||||
[3] = "CHAP-Password",
|
||||
[4] = "NAS-IP-Address",
|
||||
[5] = "NAS-Port",
|
||||
[6] = "Service-Type",
|
||||
[7] = "Framed-Protocol",
|
||||
[8] = "Framed-IP-Address",
|
||||
[9] = "Framed-IP-Netmask",
|
||||
[10] = "Framed-Routing",
|
||||
[11] = "Filter-Id",
|
||||
[12] = "Framed-MTU",
|
||||
[13] = "Framed-Compression",
|
||||
[14] = "Login-IP-Host",
|
||||
[15] = "Login-Service",
|
||||
[16] = "Login-TCP-Port",
|
||||
[18] = "Reply-Message",
|
||||
[19] = "Callback-Number",
|
||||
[20] = "Callback-Id",
|
||||
[22] = "Framed-Route",
|
||||
[23] = "Framed-IPX-Network",
|
||||
[24] = "State",
|
||||
[25] = "Class",
|
||||
[26] = "Vendor-Specific",
|
||||
[27] = "Session-Timeout",
|
||||
[28] = "Idle-Timeout",
|
||||
[29] = "Termination-Action",
|
||||
[30] = "Called-Station-Id",
|
||||
[31] = "Calling-Station-Id",
|
||||
[32] = "NAS-Identifier",
|
||||
[33] = "Proxy-State",
|
||||
[34] = "Login-LAT-Service",
|
||||
[35] = "Login-LAT-Node",
|
||||
[36] = "Login-LAT-Group",
|
||||
[37] = "Framed-AppleTalk-Link",
|
||||
[38] = "Framed-AppleTalk-Network",
|
||||
[39] = "Framed-AppleTalk-Zone",
|
||||
[40] = "Acct-Status-Type",
|
||||
[41] = "Acct-Delay-Time",
|
||||
[42] = "Acct-Input-Octets",
|
||||
[43] = "Acct-Output-Octets",
|
||||
[44] = "Acct-Session-Id",
|
||||
[45] = "Acct-Authentic",
|
||||
[46] = "Acct-Session-Time",
|
||||
[47] = "Acct-Input-Packets",
|
||||
[48] = "Acct-Output-Packets",
|
||||
[49] = "Acct-Terminate-Cause",
|
||||
[50] = "Acct-Multi-Session-Id",
|
||||
[51] = "Acct-Link-Count",
|
||||
[52] = "Acct-Input-Gigawords",
|
||||
[53] = "Acct-Output-Gigawords",
|
||||
[55] = "Event-Timestamp",
|
||||
[56] = "Egress-VLANID",
|
||||
[57] = "Ingress-Filters",
|
||||
[58] = "Egress-VLAN-Name",
|
||||
[59] = "User-Priority-Table",
|
||||
[60] = "CHAP-Challenge",
|
||||
[61] = "NAS-Port-Type",
|
||||
[62] = "Port-Limit",
|
||||
[63] = "Login-LAT-Port",
|
||||
[64] = "Tunnel-Type",
|
||||
[65] = "Tunnel-Medium-Type",
|
||||
[66] = "Tunnel-Client-EndPoint",
|
||||
[67] = "Tunnel-Server-EndPoint",
|
||||
[68] = "Acct-Tunnel-Connection",
|
||||
[69] = "Tunnel-Password",
|
||||
[70] = "ARAP-Password",
|
||||
[71] = "ARAP-Features",
|
||||
[72] = "ARAP-Zone-Access",
|
||||
[73] = "ARAP-Security",
|
||||
[74] = "ARAP-Security-Data",
|
||||
[75] = "Password-Retry",
|
||||
[76] = "Prompt",
|
||||
[77] = "Connect-Info",
|
||||
[78] = "Configuration-Token",
|
||||
[79] = "EAP-Message",
|
||||
[80] = "Message Authenticator",
|
||||
[81] = "Tunnel-Private-Group-ID",
|
||||
[82] = "Tunnel-Assignment-ID",
|
||||
[83] = "Tunnel-Preference",
|
||||
[84] = "ARAP-Challenge-Response",
|
||||
[85] = "Acct-Interim-Interval",
|
||||
[86] = "Acct-Tunnel-Packets-Lost",
|
||||
[87] = "NAS-Port-Id",
|
||||
[88] = "Framed-Pool",
|
||||
[89] = "CUI",
|
||||
[90] = "Tunnel-Client-Auth-ID",
|
||||
[91] = "Tunnel-Server-Auth-ID",
|
||||
[92] = "NAS-Filter-Rule",
|
||||
[94] = "Originating-Line-Info",
|
||||
[95] = "NAS-IPv6-Address",
|
||||
[96] = "Framed-Interface-Id",
|
||||
[97] = "Framed-IPv6-Prefix",
|
||||
[98] = "Login-IPv6-Host",
|
||||
[99] = "Framed-IPv6-Route",
|
||||
[100] = "Framed-IPv6-Pool",
|
||||
[101] = "Error-Cause",
|
||||
[102] = "EAP-Key-Name",
|
||||
[103] = "Digest-Response",
|
||||
[104] = "Digest-Realm",
|
||||
[105] = "Digest-Nonce",
|
||||
[106] = "Digest-Response-Auth",
|
||||
[107] = "Digest-Nextnonce",
|
||||
[108] = "Digest-Method",
|
||||
[109] = "Digest-URI",
|
||||
[110] = "Digest-Qop",
|
||||
[111] = "Digest-Algorithm",
|
||||
[112] = "Digest-Entity-Body-Hash",
|
||||
[113] = "Digest-CNonce",
|
||||
[114] = "Digest-Nonce-Count",
|
||||
[115] = "Digest-Username",
|
||||
[116] = "Digest-Opaque",
|
||||
[117] = "Digest-Auth-Param",
|
||||
[118] = "Digest-AKA-Auts",
|
||||
[119] = "Digest-Domain",
|
||||
[120] = "Digest-Stale",
|
||||
[121] = "Digest-HA1",
|
||||
[122] = "SIP-AOR",
|
||||
[123] = "Delegated-IPv6-Prefix",
|
||||
[124] = "MIP6-Feature-Vector",
|
||||
[125] = "MIP6-Home-Link-Prefix",
|
||||
[126] = "Operator-Name",
|
||||
[127] = "Location-Information",
|
||||
[128] = "Location-Data",
|
||||
[129] = "Basic-Location-Policy-Rules",
|
||||
[130] = "Extended-Location-Policy-Rules",
|
||||
[131] = "Location-Capable",
|
||||
[132] = "Requested-Location-Info",
|
||||
[133] = "Framed-Management-Protocol",
|
||||
[134] = "Management-Transport-Protection",
|
||||
[135] = "Management-Policy-Id",
|
||||
[136] = "Management-Privilege-Level",
|
||||
[137] = "PKM-SS-Cert",
|
||||
[138] = "PKM-CA-Cert",
|
||||
[139] = "PKM-Config-Settings",
|
||||
[140] = "PKM-Cryptosuite-List",
|
||||
[141] = "PKM-SAID",
|
||||
[142] = "PKM-SA-Descriptor",
|
||||
[143] = "PKM-Auth-Key",
|
||||
[144] = "DS-Lite-Tunnel-Name",
|
||||
[145] = "Mobile-Node-Identifier",
|
||||
[146] = "Service-Selection",
|
||||
[147] = "PMIP6-Home-LMA-IPv6-Address",
|
||||
[148] = "PMIP6-Visited-LMA-IPv6-Address",
|
||||
[149] = "PMIP6-Home-LMA-IPv4-Address",
|
||||
[150] = "PMIP6-Visited-LMA-IPv4-Address",
|
||||
[151] = "PMIP6-Home-HN-Prefix",
|
||||
[152] = "PMIP6-Visited-HN-Prefix",
|
||||
[153] = "PMIP6-Home-Interface-ID",
|
||||
[154] = "PMIP6-Visited-Interface-ID",
|
||||
[155] = "PMIP6-Home-IPv4-HoA",
|
||||
[156] = "PMIP6-Visited-IPv4-HoA",
|
||||
[157] = "PMIP6-Home-DHCP4-Server-Address",
|
||||
[158] = "PMIP6-Visited-DHCP4-Server-Address",
|
||||
[159] = "PMIP6-Home-DHCP6-Server-Address",
|
||||
[160] = "PMIP6-Visited-DHCP6-Server-Address",
|
||||
[161] = "PMIP6-Home-IPv4-Gateway",
|
||||
[162] = "PMIP6-Visited-IPv4-Gateway",
|
||||
[163] = "EAP-Lower-Layer",
|
||||
[164] = "GSS-Acceptor-Service-Name",
|
||||
[165] = "GSS-Acceptor-Host-Name",
|
||||
[166] = "GSS-Acceptor-Service-Specifics",
|
||||
[167] = "GSS-Acceptor-Realm-Name",
|
||||
[168] = "Framed-IPv6-Address",
|
||||
[169] = "DNS-Server-IPv6-Address",
|
||||
[170] = "Route-IPv6-Information",
|
||||
[171] = "Delegated-IPv6-Prefix-Pool",
|
||||
[172] = "Stateful-IPv6-Address-Pool",
|
||||
[173] = "IPv6-6rd-Configuration"
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
|
||||
const nas_port_types: table[count] of string = {
|
||||
[0] = "Async",
|
||||
[1] = "Sync",
|
||||
[2] = "ISDN Sync",
|
||||
[3] = "ISDN Async V.120",
|
||||
[4] = "ISDN Async V.110",
|
||||
[5] = "Virtual",
|
||||
[6] = "PIAFS",
|
||||
[7] = "HDLC Clear Channel",
|
||||
[8] = "X.25",
|
||||
[9] = "X.75",
|
||||
[10] = "G.3 Fax",
|
||||
[11] = "SDSL - Symmetric DSL",
|
||||
[12] = "ADSL-CAP - Asymmetric DSL, Carrierless Amplitude Phase Modulation",
|
||||
[13] = "ADSL-DMT - Asymmetric DSL, Discrete Multi-Tone",
|
||||
[14] = "IDSL - ISDN Digital Subscriber Line",
|
||||
[15] = "Ethernet",
|
||||
[16] = "xDSL - Digital Subscriber Line of unknown type",
|
||||
[17] = "Cable",
|
||||
[18] = "Wireless - Other",
|
||||
[19] = "Wireless - IEEE 802.11"
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
|
||||
const service_types: table[count] of string = {
|
||||
[1] = "Login",
|
||||
[2] = "Framed",
|
||||
[3] = "Callback Login",
|
||||
[4] = "Callback Framed",
|
||||
[5] = "Outbound",
|
||||
[6] = "Administrative",
|
||||
[7] = "NAS Prompt",
|
||||
[8] = "Authenticate Only",
|
||||
[9] = "Callback NAS Prompt",
|
||||
[10] = "Call Check",
|
||||
[11] = "Callback Administrative",
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
|
||||
const framed_protocol_types: table[count] of string = {
|
||||
[1] = "PPP",
|
||||
[2] = "SLIP",
|
||||
[3] = "AppleTalk Remote Access Protocol (ARAP)",
|
||||
[4] = "Gandalf proprietary SingleLink/MultiLink protocol",
|
||||
[5] = "Xylogics proprietary IPX/SLIP",
|
||||
[6] = "X.75 Synchronous"
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
126
scripts/base/protocols/radius/main.bro
Normal file
126
scripts/base/protocols/radius/main.bro
Normal file
|
|
@ -0,0 +1,126 @@
|
|||
##! Implements base functionality for RADIUS analysis. Generates the radius.log file.
|
||||
|
||||
module RADIUS;
|
||||
|
||||
@load ./consts.bro
|
||||
@load base/utils/addrs
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { LOG };
|
||||
|
||||
type Info: record {
|
||||
## Timestamp for when the event happened.
|
||||
ts : time &log;
|
||||
## Unique ID for the connection.
|
||||
uid : string &log;
|
||||
## The connection's 4-tuple of endpoint addresses/ports.
|
||||
id : conn_id &log;
|
||||
## The username, if present.
|
||||
username : string &log &optional;
|
||||
## MAC address, if present.
|
||||
mac : string &log &optional;
|
||||
## Remote IP address, if present.
|
||||
remote_ip : addr &log &optional;
|
||||
## Connect info, if present.
|
||||
connect_info : string &log &optional;
|
||||
## Successful or failed authentication.
|
||||
result : string &log &optional;
|
||||
## Whether this has already been logged and can be ignored.
|
||||
logged : bool &optional;
|
||||
|
||||
};
|
||||
|
||||
## The amount of time we wait for an authentication response before
|
||||
## expiring it.
|
||||
const expiration_interval = 10secs &redef;
|
||||
|
||||
## Logs an authentication attempt if we didn't see a response in time.
|
||||
##
|
||||
## t: A table of Info records.
|
||||
##
|
||||
## idx: The index of the connection$radius table corresponding to the
|
||||
## radius authentication about to expire.
|
||||
##
|
||||
## Returns: 0secs, which when this function is used as an
|
||||
## :bro:attr:`&expire_func`, indicates to remove the element at
|
||||
## *idx* immediately.
|
||||
global expire: function(t: table[count] of Info, idx: count): interval;
|
||||
|
||||
## Event that can be handled to access the RADIUS record as it is sent on
|
||||
## to the loggin framework.
|
||||
global log_radius: event(rec: Info);
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
radius: table[count] of Info &optional &write_expire=expiration_interval &expire_func=expire;
|
||||
};
|
||||
|
||||
const ports = { 1812/udp };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(RADIUS::LOG, [$columns=Info, $ev=log_radius]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_RADIUS, ports);
|
||||
}
|
||||
|
||||
event radius_message(c: connection, result: RADIUS::Message)
|
||||
{
|
||||
local info: Info;
|
||||
|
||||
if ( c?$radius && result$trans_id in c$radius )
|
||||
info = c$radius[result$trans_id];
|
||||
else
|
||||
{
|
||||
c$radius = table();
|
||||
info$ts = network_time();
|
||||
info$uid = c$uid;
|
||||
info$id = c$id;
|
||||
}
|
||||
|
||||
switch ( RADIUS::msg_types[result$code] ) {
|
||||
case "Access-Request":
|
||||
if ( result?$attributes ) {
|
||||
# User-Name
|
||||
if ( ! info?$username && 1 in result$attributes )
|
||||
info$username = result$attributes[1][0];
|
||||
|
||||
# Calling-Station-Id (we expect this to be a MAC)
|
||||
if ( ! info?$mac && 31 in result$attributes )
|
||||
info$mac = normalize_mac(result$attributes[31][0]);
|
||||
|
||||
# Tunnel-Client-EndPoint (useful for VPNs)
|
||||
if ( ! info?$remote_ip && 66 in result$attributes )
|
||||
info$remote_ip = to_addr(result$attributes[66][0]);
|
||||
|
||||
# Connect-Info
|
||||
if ( ! info?$connect_info && 77 in result$attributes )
|
||||
info$connect_info = result$attributes[77][0];
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case "Access-Accept":
|
||||
info$result = "success";
|
||||
break;
|
||||
|
||||
case "Access-Reject":
|
||||
info$result = "failed";
|
||||
break;
|
||||
}
|
||||
|
||||
if ( info?$result && ! info?$logged )
|
||||
{
|
||||
info$logged = T;
|
||||
Log::write(RADIUS::LOG, info);
|
||||
}
|
||||
|
||||
c$radius[result$trans_id] = info;
|
||||
}
|
||||
|
||||
|
||||
function expire(t: table[count] of Info, idx: count): interval
|
||||
{
|
||||
t[idx]$result = "unknown";
|
||||
Log::write(RADIUS::LOG, t[idx]);
|
||||
return 0secs;
|
||||
}
|
||||
|
|
@ -41,13 +41,13 @@ function describe_file(f: fa_file): string
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Files::register_protocol(Analyzer::ANALYZER_SMTP,
|
||||
Files::register_protocol(Analyzer::ANALYZER_SMTP,
|
||||
[$get_file_handle = SMTP::get_file_handle,
|
||||
$describe = SMTP::describe_file]);
|
||||
}
|
||||
|
||||
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
|
||||
{
|
||||
if ( c?$smtp )
|
||||
if ( c?$smtp && !c$smtp$tls )
|
||||
c$smtp$fuids[|c$smtp$fuids|] = f$id;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -49,38 +49,40 @@ export {
|
|||
path: vector of addr &log &optional;
|
||||
## Value of the User-Agent header from the client.
|
||||
user_agent: string &log &optional;
|
||||
|
||||
|
||||
## Indicates that the connection has switched to using TLS.
|
||||
tls: bool &log &default=F;
|
||||
## Indicates if the "Received: from" headers should still be
|
||||
## processed.
|
||||
process_received_from: bool &default=T;
|
||||
## Indicates if client activity has been seen, but not yet logged.
|
||||
has_client_activity: bool &default=F;
|
||||
};
|
||||
|
||||
|
||||
type State: record {
|
||||
helo: string &optional;
|
||||
## Count the number of individual messages transmitted during
|
||||
## this SMTP session. Note, this is not the number of
|
||||
## recipients, but the number of message bodies transferred.
|
||||
messages_transferred: count &default=0;
|
||||
|
||||
|
||||
pending_messages: set[Info] &optional;
|
||||
};
|
||||
|
||||
|
||||
## Direction to capture the full "Received from" path.
|
||||
## REMOTE_HOSTS - only capture the path until an internal host is found.
|
||||
## LOCAL_HOSTS - only capture the path until the external host is discovered.
|
||||
## ALL_HOSTS - always capture the entire path.
|
||||
## NO_HOSTS - never capture the path.
|
||||
const mail_path_capture = ALL_HOSTS &redef;
|
||||
|
||||
|
||||
## Create an extremely shortened representation of a log line.
|
||||
global describe: function(rec: Info): string;
|
||||
|
||||
global log_smtp: event(rec: Info);
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
redef record connection += {
|
||||
smtp: Info &optional;
|
||||
smtp_state: State &optional;
|
||||
};
|
||||
|
|
@ -93,7 +95,7 @@ event bro_init() &priority=5
|
|||
Log::create_stream(SMTP::LOG, [$columns=SMTP::Info, $ev=log_smtp]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_SMTP, ports);
|
||||
}
|
||||
|
||||
|
||||
function find_address_in_smtp_header(header: string): string
|
||||
{
|
||||
local ips = find_ip_addresses(header);
|
||||
|
|
@ -114,17 +116,17 @@ function new_smtp_log(c: connection): Info
|
|||
l$ts=network_time();
|
||||
l$uid=c$uid;
|
||||
l$id=c$id;
|
||||
# The messages_transferred count isn't incremented until the message is
|
||||
# The messages_transferred count isn't incremented until the message is
|
||||
# finished so we need to increment the count by 1 here.
|
||||
l$trans_depth = c$smtp_state$messages_transferred+1;
|
||||
|
||||
|
||||
if ( c$smtp_state?$helo )
|
||||
l$helo = c$smtp_state$helo;
|
||||
|
||||
|
||||
# The path will always end with the hosts involved in this connection.
|
||||
# The lower values in the vector are the end of the path.
|
||||
l$path = vector(c$id$resp_h, c$id$orig_h);
|
||||
|
||||
|
||||
return l;
|
||||
}
|
||||
|
||||
|
|
@ -132,7 +134,7 @@ function set_smtp_session(c: connection)
|
|||
{
|
||||
if ( ! c?$smtp_state )
|
||||
c$smtp_state = [];
|
||||
|
||||
|
||||
if ( ! c?$smtp )
|
||||
c$smtp = new_smtp_log(c);
|
||||
}
|
||||
|
|
@ -140,17 +142,17 @@ function set_smtp_session(c: connection)
|
|||
function smtp_message(c: connection)
|
||||
{
|
||||
if ( c$smtp$has_client_activity )
|
||||
{
|
||||
Log::write(SMTP::LOG, c$smtp);
|
||||
c$smtp = new_smtp_log(c);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &priority=5
|
||||
{
|
||||
set_smtp_session(c);
|
||||
local upper_command = to_upper(command);
|
||||
|
||||
if ( upper_command != "QUIT" )
|
||||
c$smtp$has_client_activity = T;
|
||||
|
||||
if ( upper_command == "HELO" || upper_command == "EHLO" )
|
||||
{
|
||||
c$smtp_state$helo = arg;
|
||||
|
|
@ -159,23 +161,28 @@ event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &
|
|||
|
||||
else if ( upper_command == "RCPT" && /^[tT][oO]:/ in arg )
|
||||
{
|
||||
if ( ! c$smtp?$rcptto )
|
||||
if ( ! c$smtp?$rcptto )
|
||||
c$smtp$rcptto = set();
|
||||
add c$smtp$rcptto[split1(arg, /:[[:blank:]]*/)[2]];
|
||||
c$smtp$has_client_activity = T;
|
||||
}
|
||||
|
||||
else if ( upper_command == "MAIL" && /^[fF][rR][oO][mM]:/ in arg )
|
||||
{
|
||||
# Flush last message in case we didn't see the server's acknowledgement.
|
||||
smtp_message(c);
|
||||
|
||||
local partially_done = split1(arg, /:[[:blank:]]*/)[2];
|
||||
c$smtp$mailfrom = split1(partially_done, /[[:blank:]]?/)[1];
|
||||
c$smtp$has_client_activity = T;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
||||
msg: string, cont_resp: bool) &priority=5
|
||||
{
|
||||
set_smtp_session(c);
|
||||
|
||||
|
||||
# This continually overwrites, but we want the last reply,
|
||||
# so this actually works fine.
|
||||
c$smtp$last_reply = fmt("%d %s", code, msg);
|
||||
|
|
@ -196,7 +203,6 @@ event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
|||
event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
c$smtp$has_client_activity = T;
|
||||
|
||||
if ( h$name == "MESSAGE-ID" )
|
||||
c$smtp$msg_id = h$value;
|
||||
|
|
@ -239,19 +245,19 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
|||
if ( 1 in addresses )
|
||||
c$smtp$x_originating_ip = to_addr(addresses[1]);
|
||||
}
|
||||
|
||||
|
||||
else if ( h$name == "X-MAILER" ||
|
||||
h$name == "USER-AGENT" ||
|
||||
h$name == "X-USER-AGENT" )
|
||||
c$smtp$user_agent = h$value;
|
||||
}
|
||||
|
||||
# This event handler builds the "Received From" path by reading the
|
||||
|
||||
# This event handler builds the "Received From" path by reading the
|
||||
# headers in the mail
|
||||
event mime_one_header(c: connection, h: mime_header_rec) &priority=3
|
||||
{
|
||||
# If we've decided that we're done watching the received headers for
|
||||
# whatever reason, we're done. Could be due to only watching until
|
||||
# whatever reason, we're done. Could be due to only watching until
|
||||
# local addresses are seen in the received from headers.
|
||||
if ( ! c?$smtp || h$name != "RECEIVED" || ! c$smtp$process_received_from )
|
||||
return;
|
||||
|
|
@ -261,7 +267,7 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=3
|
|||
return;
|
||||
local ip = to_addr(text_ip);
|
||||
|
||||
if ( ! addr_matches_host(ip, mail_path_capture) &&
|
||||
if ( ! addr_matches_host(ip, mail_path_capture) &&
|
||||
! Site::is_private_addr(ip) )
|
||||
{
|
||||
c$smtp$process_received_from = F;
|
||||
|
|
@ -276,6 +282,15 @@ event connection_state_remove(c: connection) &priority=-5
|
|||
smtp_message(c);
|
||||
}
|
||||
|
||||
event smtp_starttls(c: connection) &priority=5
|
||||
{
|
||||
if ( c?$smtp )
|
||||
{
|
||||
c$smtp$tls = T;
|
||||
c$smtp$has_client_activity = T;
|
||||
}
|
||||
}
|
||||
|
||||
function describe(rec: Info): string
|
||||
{
|
||||
if ( rec?$mailfrom && rec?$rcptto )
|
||||
|
|
|
|||
|
|
@ -1,15 +1,182 @@
|
|||
##! Enables analysis of SNMP datagrams.
|
||||
##! Enables analysis and logging of SNMP datagrams.
|
||||
|
||||
module SNMP;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { LOG };
|
||||
|
||||
## Information tracked per SNMP session.
|
||||
type Info: record {
|
||||
## Timestamp of first packet belonging to the SNMP session.
|
||||
ts: time &log;
|
||||
## The unique ID for the connection.
|
||||
uid: string &log;
|
||||
## The connection's 5-tuple of addresses/ports (ports inherently
|
||||
## include transport protocol information)
|
||||
id: conn_id &log;
|
||||
## The amount of time between the first packet beloning to
|
||||
## the SNMP session and the latest one seen.
|
||||
duration: interval &log &default=0secs;
|
||||
## The version of SNMP being used.
|
||||
version: string &log;
|
||||
## The community string of the first SNMP packet associated with
|
||||
## the session. This is used as part of SNMP's (v1 and v2c)
|
||||
## administrative/security framework. See :rfc:`1157` or :rfc:`1901`.
|
||||
community: string &log &optional;
|
||||
|
||||
## The number of variable bindings in GetRequest/GetNextRequest PDUs
|
||||
## seen for the session.
|
||||
get_requests: count &log &default=0;
|
||||
## The number of variable bindings in GetBulkRequest PDUs seen for
|
||||
## the session.
|
||||
get_bulk_requests: count &log &default=0;
|
||||
## The number of variable bindings in GetResponse/Response PDUs seen
|
||||
## for the session.
|
||||
get_responses: count &log &default=0;
|
||||
## The number of variable bindings in SetRequest PDUs seen for
|
||||
## the session.
|
||||
set_requests: count &log &default=0;
|
||||
|
||||
## A system description of the SNMP responder endpoint.
|
||||
display_string: string &log &optional;
|
||||
## The time at which the SNMP responder endpoint claims it's been
|
||||
## up since.
|
||||
up_since: time &log &optional;
|
||||
};
|
||||
|
||||
## Maps an SNMP version integer to a human readable string.
|
||||
const version_map: table[count] of string = {
|
||||
[0] = "1",
|
||||
[1] = "2c",
|
||||
[3] = "3",
|
||||
} &redef &default="unknown";
|
||||
|
||||
## Event that can be handled to access the SNMP record as it is sent on
|
||||
## to the logging framework.
|
||||
global log_snmp: event(rec: Info);
|
||||
}
|
||||
|
||||
const ports = { 161/udp, 162/udp };
|
||||
redef record connection += {
|
||||
snmp: SNMP::Info &optional;
|
||||
};
|
||||
|
||||
const ports = { 161/udp, 162/udp };
|
||||
redef likely_server_ports += { ports };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_SNMP, ports);
|
||||
Log::create_stream(SNMP::LOG, [$columns=SNMP::Info, $ev=log_snmp]);
|
||||
}
|
||||
|
||||
function init_state(c: connection, h: SNMP::Header): Info
|
||||
{
|
||||
if ( ! c?$snmp )
|
||||
{
|
||||
c$snmp = Info($ts=network_time(),
|
||||
$uid=c$uid, $id=c$id,
|
||||
$version=version_map[h$version]);
|
||||
}
|
||||
|
||||
local s = c$snmp;
|
||||
|
||||
if ( ! s?$community )
|
||||
{
|
||||
if ( h?$v1 )
|
||||
s$community = h$v1$community;
|
||||
else if ( h?$v2 )
|
||||
s$community = h$v2$community;
|
||||
}
|
||||
|
||||
s$duration = network_time() - s$ts;
|
||||
return s;
|
||||
}
|
||||
|
||||
|
||||
event connection_state_remove(c: connection) &priority=-5
|
||||
{
|
||||
if ( c?$snmp )
|
||||
Log::write(LOG, c$snmp);
|
||||
}
|
||||
|
||||
event snmp_get_request(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
local s = init_state(c, header);
|
||||
s$get_requests += |pdu$bindings|;
|
||||
}
|
||||
|
||||
event snmp_get_bulk_request(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::BulkPDU) &priority=5
|
||||
{
|
||||
local s = init_state(c, header);
|
||||
s$get_bulk_requests += |pdu$bindings|;
|
||||
}
|
||||
|
||||
event snmp_get_next_request(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
local s = init_state(c, header);
|
||||
s$get_requests += |pdu$bindings|;
|
||||
}
|
||||
|
||||
event snmp_response(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
local s = init_state(c, header);
|
||||
s$get_responses += |pdu$bindings|;
|
||||
|
||||
for ( i in pdu$bindings )
|
||||
{
|
||||
local binding = pdu$bindings[i];
|
||||
|
||||
if ( binding$oid == "1.3.6.1.2.1.1.1.0" && binding$value?$octets )
|
||||
c$snmp$display_string = binding$value$octets;
|
||||
else if ( binding$oid == "1.3.6.1.2.1.1.3.0" && binding$value?$unsigned )
|
||||
{
|
||||
local up_seconds = binding$value$unsigned / 100.0;
|
||||
s$up_since = network_time() - double_to_interval(up_seconds);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event snmp_set_request(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
local s = init_state(c, header);
|
||||
s$set_requests += |pdu$bindings|;
|
||||
}
|
||||
|
||||
event snmp_trap(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::TrapPDU) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
event snmp_inform_request(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
event snmp_trapV2(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
event snmp_report(c: connection, is_orig: bool, header: SNMP::Header, pdu: SNMP::PDU) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
event snmp_unknown_pdu(c: connection, is_orig: bool, header: SNMP::Header, tag: count) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
event snmp_unknown_scoped_pdu(c: connection, is_orig: bool, header: SNMP::Header, tag: count) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
event snmp_encrypted_pdu(c: connection, is_orig: bool, header: SNMP::Header) &priority=5
|
||||
{
|
||||
init_state(c, header);
|
||||
}
|
||||
|
||||
#event snmp_unknown_header_version(c: connection, is_orig: bool, version: count) &priority=5
|
||||
# {
|
||||
# }
|
||||
|
|
|
|||
|
|
@ -14,15 +14,41 @@ export {
|
|||
[TLSv11] = "TLSv11",
|
||||
[TLSv12] = "TLSv12",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
## Mapping between numeric codes and human readable strings for alert
|
||||
|
||||
## TLS content types:
|
||||
const CHANGE_CIPHER_SPEC = 20;
|
||||
const ALERT = 21;
|
||||
const HANDSHAKE = 22;
|
||||
const APPLICATION_DATA = 23;
|
||||
const HEARTBEAT = 24;
|
||||
const V2_ERROR = 300;
|
||||
const V2_CLIENT_HELLO = 301;
|
||||
const V2_CLIENT_MASTER_KEY = 302;
|
||||
const V2_SERVER_HELLO = 304;
|
||||
|
||||
## TLS Handshake types:
|
||||
const HELLO_REQUEST = 0;
|
||||
const CLIENT_HELLO = 1;
|
||||
const SERVER_HELLO = 2;
|
||||
const SESSION_TICKET = 4; # RFC 5077
|
||||
const CERTIFICATE = 11;
|
||||
const SERVER_KEY_EXCHANGE = 12;
|
||||
const CERTIFICATE_REQUEST = 13;
|
||||
const SERVER_HELLO_DONE = 14;
|
||||
const CERTIFICATE_VERIFY = 15;
|
||||
const CLIENT_KEY_EXCHANGE = 16;
|
||||
const FINISHED = 20;
|
||||
const CERTIFICATE_URL = 21; # RFC 3546
|
||||
const CERTIFICATE_STATUS = 22; # RFC 3546
|
||||
|
||||
## Mapping between numeric codes and human readable strings for alert
|
||||
## levels.
|
||||
const alert_levels: table[count] of string = {
|
||||
[1] = "warning",
|
||||
[2] = "fatal",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
## Mapping between numeric codes and human readable strings for alert
|
||||
|
||||
## Mapping between numeric codes and human readable strings for alert
|
||||
## descriptions.
|
||||
const alert_descriptions: table[count] of string = {
|
||||
[0] = "close_notify",
|
||||
|
|
@ -58,7 +84,7 @@ export {
|
|||
[115] = "unknown_psk_identity",
|
||||
[120] = "no_application_protocol",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
|
||||
## Mapping between numeric codes and human readable strings for SSL/TLS
|
||||
## extensions.
|
||||
# More information can be found here:
|
||||
|
|
@ -83,6 +109,10 @@ export {
|
|||
[16] = "application_layer_protocol_negotiation",
|
||||
[17] = "status_request_v2",
|
||||
[18] = "signed_certificate_timestamp",
|
||||
[19] = "client_certificate_type",
|
||||
[20] = "server_certificate_type",
|
||||
[21] = "padding", # temporary till 2015-03-12
|
||||
[22] = "encrypt_then_mac", # temporary till 2015-06-05
|
||||
[35] = "SessionTicket TLS",
|
||||
[40] = "extended_random",
|
||||
[13172] = "next_protocol_negotiation",
|
||||
|
|
@ -93,7 +123,50 @@ export {
|
|||
[35655] = "padding",
|
||||
[65281] = "renegotiation_info"
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
|
||||
## Mapping between numeric codes and human readable string for SSL/TLS elliptic curves.
|
||||
# See http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
|
||||
const ec_curves: table[count] of string = {
|
||||
[1] = "sect163k1",
|
||||
[2] = "sect163r1",
|
||||
[3] = "sect163r2",
|
||||
[4] = "sect193r1",
|
||||
[5] = "sect193r2",
|
||||
[6] = "sect233k1",
|
||||
[7] = "sect233r1",
|
||||
[8] = "sect239k1",
|
||||
[9] = "sect283k1",
|
||||
[10] = "sect283r1",
|
||||
[11] = "sect409k1",
|
||||
[12] = "sect409r1",
|
||||
[13] = "sect571k1",
|
||||
[14] = "sect571r1",
|
||||
[15] = "secp160k1",
|
||||
[16] = "secp160r1",
|
||||
[17] = "secp160r2",
|
||||
[18] = "secp192k1",
|
||||
[19] = "secp192r1",
|
||||
[20] = "secp224k1",
|
||||
[21] = "secp224r1",
|
||||
[22] = "secp256k1",
|
||||
[23] = "secp256r1",
|
||||
[24] = "secp384r1",
|
||||
[25] = "secp521r1",
|
||||
[26] = "brainpoolP256r1",
|
||||
[27] = "brainpoolP384r1",
|
||||
[28] = "brainpoolP512r1",
|
||||
[0xFF01] = "arbitrary_explicit_prime_curves",
|
||||
[0xFF02] = "arbitrary_explicit_char2_curves"
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
## Mapping between numeric codes and human readable string for SSL/TLC EC point formats.
|
||||
# See http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-9
|
||||
const ec_point_formats: table[count] of string = {
|
||||
[0] = "uncompressed",
|
||||
[1] = "ansiX962_compressed_prime",
|
||||
[2] = "ansiX962_compressed_char2"
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
# SSLv2
|
||||
const SSLv20_CK_RC4_128_WITH_MD5 = 0x010080;
|
||||
const SSLv20_CK_RC4_128_EXPORT40_WITH_MD5 = 0x020080;
|
||||
|
|
@ -444,6 +517,10 @@ export {
|
|||
const TLS_PSK_WITH_AES_256_CCM_8 = 0xC0A9;
|
||||
const TLS_PSK_DHE_WITH_AES_128_CCM_8 = 0xC0AA;
|
||||
const TLS_PSK_DHE_WITH_AES_256_CCM_8 = 0xC0AB;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_CCM = 0xC0AC;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_CCM = 0xC0AD;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 = 0xC0AE;
|
||||
const TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 = 0xC0AF;
|
||||
# draft-agl-tls-chacha20poly1305-02
|
||||
const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xCC13;
|
||||
const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 = 0xCC14;
|
||||
|
|
@ -458,8 +535,8 @@ export {
|
|||
const SSL_RSA_WITH_DES_CBC_MD5 = 0xFF82;
|
||||
const SSL_RSA_WITH_3DES_EDE_CBC_MD5 = 0xFF83;
|
||||
const TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0x00FF;
|
||||
|
||||
## This is a table of all known cipher specs. It can be used for
|
||||
|
||||
## This is a table of all known cipher specs. It can be used for
|
||||
## detecting unknown ciphers and for converting the cipher spec
|
||||
## constants into a human readable format.
|
||||
const cipher_desc: table[count] of string = {
|
||||
|
|
@ -807,6 +884,10 @@ export {
|
|||
[TLS_PSK_WITH_AES_256_CCM_8] = "TLS_PSK_WITH_AES_256_CCM_8",
|
||||
[TLS_PSK_DHE_WITH_AES_128_CCM_8] = "TLS_PSK_DHE_WITH_AES_128_CCM_8",
|
||||
[TLS_PSK_DHE_WITH_AES_256_CCM_8] = "TLS_PSK_DHE_WITH_AES_256_CCM_8",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_CCM] = "TLS_ECDHE_ECDSA_WITH_AES_128_CCM",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_CCM] = "TLS_ECDHE_ECDSA_WITH_AES_256_CCM",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8] = "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8",
|
||||
[TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8] = "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8",
|
||||
[TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256] = "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
|
||||
[TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256] = "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
|
||||
[TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256] = "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
|
||||
|
|
@ -820,43 +901,5 @@ export {
|
|||
[SSL_RSA_WITH_3DES_EDE_CBC_MD5] = "SSL_RSA_WITH_3DES_EDE_CBC_MD5",
|
||||
[TLS_EMPTY_RENEGOTIATION_INFO_SCSV] = "TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
## Mapping between the constants and string values for SSL/TLS errors.
|
||||
const x509_errors: table[count] of string = {
|
||||
[0] = "ok",
|
||||
[1] = "unable to get issuer cert",
|
||||
[2] = "unable to get crl",
|
||||
[3] = "unable to decrypt cert signature",
|
||||
[4] = "unable to decrypt crl signature",
|
||||
[5] = "unable to decode issuer public key",
|
||||
[6] = "cert signature failure",
|
||||
[7] = "crl signature failure",
|
||||
[8] = "cert not yet valid",
|
||||
[9] = "cert has expired",
|
||||
[10] = "crl not yet valid",
|
||||
[11] = "crl has expired",
|
||||
[12] = "error in cert not before field",
|
||||
[13] = "error in cert not after field",
|
||||
[14] = "error in crl last update field",
|
||||
[15] = "error in crl next update field",
|
||||
[16] = "out of mem",
|
||||
[17] = "depth zero self signed cert",
|
||||
[18] = "self signed cert in chain",
|
||||
[19] = "unable to get issuer cert locally",
|
||||
[20] = "unable to verify leaf signature",
|
||||
[21] = "cert chain too long",
|
||||
[22] = "cert revoked",
|
||||
[23] = "invalid ca",
|
||||
[24] = "path length exceeded",
|
||||
[25] = "invalid purpose",
|
||||
[26] = "cert untrusted",
|
||||
[27] = "cert rejected",
|
||||
[28] = "subject issuer mismatch",
|
||||
[29] = "akid skid mismatch",
|
||||
[30] = "akid issuer serial mismatch",
|
||||
[31] = "keyusage no certsign",
|
||||
[32] = "unable to get crl issuer",
|
||||
[33] = "unhandled critical extension",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -52,22 +52,8 @@ export {
|
|||
|
||||
function get_file_handle(c: connection, is_orig: bool): string
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
local depth: count;
|
||||
|
||||
if ( is_orig )
|
||||
{
|
||||
depth = c$ssl$client_depth;
|
||||
++c$ssl$client_depth;
|
||||
}
|
||||
else
|
||||
{
|
||||
depth = c$ssl$server_depth;
|
||||
++c$ssl$server_depth;
|
||||
}
|
||||
|
||||
return cat(Analyzer::ANALYZER_SSL, c$start_time, is_orig, id_string(c$id), depth);
|
||||
# Unused. File handles are generated in the analyzer.
|
||||
return "";
|
||||
}
|
||||
|
||||
function describe_file(f: fa_file): string
|
||||
|
|
@ -135,13 +121,15 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
event ssl_established(c: connection) &priority=6
|
||||
{
|
||||
# update subject and issuer information
|
||||
if ( c$ssl?$cert_chain && |c$ssl$cert_chain| > 0 )
|
||||
if ( c$ssl?$cert_chain && |c$ssl$cert_chain| > 0 &&
|
||||
c$ssl$cert_chain[0]?$x509 )
|
||||
{
|
||||
c$ssl$subject = c$ssl$cert_chain[0]$x509$certificate$subject;
|
||||
c$ssl$issuer = c$ssl$cert_chain[0]$x509$certificate$issuer;
|
||||
}
|
||||
|
||||
if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 )
|
||||
if ( c$ssl?$client_cert_chain && |c$ssl$client_cert_chain| > 0 &&
|
||||
c$ssl$client_cert_chain[0]?$x509 )
|
||||
{
|
||||
c$ssl$client_subject = c$ssl$client_cert_chain[0]$x509$certificate$subject;
|
||||
c$ssl$client_issuer = c$ssl$client_cert_chain[0]$x509$certificate$issuer;
|
||||
|
|
|
|||
|
|
@ -19,6 +19,8 @@ export {
|
|||
version: string &log &optional;
|
||||
## SSL/TLS cipher suite that the server chose.
|
||||
cipher: string &log &optional;
|
||||
## Elliptic curve the server chose when using ECDH/ECDHE.
|
||||
curve: string &log &optional;
|
||||
## Value of the Server Name Indicator SSL/TLS extension. It
|
||||
## indicates the server name that the client was requesting.
|
||||
server_name: string &log &optional;
|
||||
|
|
@ -159,12 +161,23 @@ event ssl_server_hello(c: connection, version: count, possible_ts: time, server_
|
|||
c$ssl$cipher = cipher_desc[cipher];
|
||||
}
|
||||
|
||||
event ssl_extension(c: connection, is_orig: bool, code: count, val: string) &priority=5
|
||||
event ssl_server_curve(c: connection, curve: count) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( is_orig && extensions[code] == "server_name" )
|
||||
c$ssl$server_name = sub_bytes(val, 6, |val|);
|
||||
c$ssl$curve = ec_curves[curve];
|
||||
}
|
||||
|
||||
event ssl_extension_server_name(c: connection, is_orig: bool, names: string_vec) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( is_orig && |names| > 0 )
|
||||
{
|
||||
c$ssl$server_name = names[0];
|
||||
if ( |names| > 1 )
|
||||
event conn_weird("SSL_many_server_names", c, cat(names));
|
||||
}
|
||||
}
|
||||
|
||||
event ssl_alert(c: connection, is_orig: bool, level: count, desc: count) &priority=5
|
||||
|
|
@ -194,7 +207,7 @@ event connection_state_remove(c: connection) &priority=-5
|
|||
|
||||
event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=5
|
||||
{
|
||||
if ( atype == Analyzer::ANALYZER_SSL )
|
||||
if ( atype == Analyzer::ANALYZER_SSL )
|
||||
{
|
||||
set_session(c);
|
||||
c$ssl$analyzer_id = aid;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue