mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
81133f3116
* origin/topic/seth/dhcp-update: Rework to the DHCP analyzer. First step of DHCP analyzer rearchitecture. Add .btest scripts for dhck_ack and dhcp_discover messages verifying that new options are correctly reported in dhcp.log records. Extend DHCP protocol analyzer with new options. BIT-1924 #merged Additional changes: * Removed known-hosts.bro as the only thing populating its table was the already-removed known-hosts-and-devices.bro. So a known_devices.log will no longer be generated. * In dhcp-options.pac, the process_relay_agent_inf_option had a memleak and also process_auto_proxy_config_option looked like it accessed one byte past the end of the available bytestring, so fixed those.
45 lines
1.3 KiB
Text
45 lines
1.3 KiB
Text
|
|
@load base/protocols/dhcp
|
|
|
|
module DHCP;
|
|
|
|
export {
|
|
redef record DHCP::Info += {
|
|
## Added by DHCP relay agents which terminate switched or
|
|
## permanent circuits. It encodes an agent-local identifier
|
|
## of the circuit from which a DHCP client-to-server packet was
|
|
## received. Typically it should represent a router or switch
|
|
## interface number.
|
|
circuit_id: string &log &optional;
|
|
|
|
## A globally unique identifier added by relay agents to identify
|
|
## the remote host end of the circuit.
|
|
agent_remote_id: string &log &optional;
|
|
|
|
## The subscriber ID is a value independent of the physical
|
|
## network configuration so that a customer's DHCP configuration
|
|
## can be given to them correctly no matter where they are
|
|
## physically connected.
|
|
subscriber_id: string &log &optional;
|
|
};
|
|
}
|
|
|
|
event DHCP::aggregate_msgs(ts: time, id: conn_id, uid: string, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options)
|
|
{
|
|
if ( options?$sub_opt )
|
|
{
|
|
for ( i in options$sub_opt )
|
|
{
|
|
local sub_opt = options$sub_opt[i];
|
|
|
|
if ( sub_opt$code == 1 )
|
|
DHCP::log_info$circuit_id = sub_opt$value;
|
|
|
|
else if ( sub_opt$code == 2 )
|
|
DHCP::log_info$agent_remote_id = sub_opt$value;
|
|
|
|
else if ( sub_opt$code == 6 )
|
|
DHCP::log_info$subscriber_id = sub_opt$value;
|
|
}
|
|
}
|
|
}
|