Skip to content

Commit 5a845ef

Browse files
0xxon0xxon
committed
Add SSH NPF
1 parent 64f37c0 commit 5a845ef

File tree

6 files changed

+72
-0
lines changed

6 files changed

+72
-0
lines changed

‎scripts/mercury/__load__.zeek‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
@load ./http
22
@load ./tcp
3+
@load ./ssh
34

45
# this has to be loaded before the TLS script - to allow the TLS script to skip logging openvpn connections
56
@if ( Analyzer::has_tag("spicy_OpenVPN_UDP") )

‎scripts/mercury/ssh.zeek‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
##! Implements SSH NPF
2+
3+
@load base/protocols/ssh
4+
5+
module Mercury::SSH;
6+
7+
redef record SSH::Info += {
8+
## Mercury NPF for client
9+
client_npf: string &log &optional;
10+
## Mercury NPF for server
11+
server_npf: string &log &optional;
12+
};
13+
14+
function fmt_list(data: vector of string): string
15+
{
16+
return bytestring_to_hexstr(join_string_vec(data, ","));
17+
}
18+
19+
event ssh_capabilities(c: connection, cookie: string, cap: SSH::Capabilities) &priority=-1
20+
{
21+
if ( ! c?$ssh )
22+
return;
23+
24+
local npf = fmt("ssh/(%s)(%s)(%s)(%s)(%s)(%s)(%s)(%s)(%s)(%s)",
25+
fmt_list(cap$kex_algorithms),
26+
fmt_list(cap$server_host_key_algorithms),
27+
fmt_list(cap$encryption_algorithms?$client_to_server ? cap$encryption_algorithms$client_to_server: vector()),
28+
fmt_list(cap$encryption_algorithms?$server_to_client ? cap$encryption_algorithms$server_to_client: vector()),
29+
fmt_list(cap$mac_algorithms?$client_to_server ? cap$mac_algorithms$client_to_server : vector()),
30+
fmt_list(cap$mac_algorithms?$server_to_client ? cap$mac_algorithms$server_to_client : vector()),
31+
fmt_list(cap$compression_algorithms?$client_to_server ? cap$compression_algorithms$client_to_server : vector()),
32+
fmt_list(cap$compression_algorithms?$server_to_client ? cap$compression_algorithms$server_to_client : vector()),
33+
fmt_list((cap?$languages && cap$languages?$client_to_server) ? cap$languages$client_to_server : vector()),
34+
fmt_list((cap?$languages && cap$languages?$server_to_client) ? cap$languages$server_to_client : vector()));
35+
36+
if ( cap$is_server )
37+
c$ssh$server_npf = npf;
38+
else
39+
c$ssh$client_npf = npf;
40+
}

‎scripts/mercury/tls.zeek‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ export {
4444
MERCURY_TLS_2
4545
};
4646

47+
## Mercury fingerprint version to use
4748
option fingerprint_version = MERCURY_TLS;
4849
}
4950

‎testing/Baseline/tests.ssh/ssh-single-conn.log‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
2+
#separator \x09
3+
#set_separator ,
4+
#empty_field (empty)
5+
#unset_field -
6+
#path ssh
7+
#open XXXX-XX-XX-XX-XX-XX
8+
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version auth_success auth_attempts direction client server cipher_alg mac_alg compression_alg kex_alg host_key_alg host_key client_npf server_npf
9+
#types time string addr port addr port count bool count enum string string string string string string string string string string
10+
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.150.186.169 49244 131.159.14.23 22 2 T 2 - SSH-2.0-OpenSSH_3.8.1p1 SSH-1.99-OpenSSH_3.9p1 aes128-cbc hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 00:0c:23:3a:f1:d9:1e:52:b0:e0:93:3d:b3:08:dd:9f ssh/(6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f7570312d73686131)(7373682d7273612c7373682d647373)(6165733132382d6362632c336465732d6362632c626c6f77666973682d6362632c636173743132382d6362632c617263666f75722c6165733139322d6362632c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733132382d6374722c6165733139322d6374722c6165733235362d637472)(6165733132382d6362632c336465732d6362632c626c6f77666973682d6362632c636173743132382d6362632c617263666f75722c6165733139322d6362632c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733132382d6374722c6165733139322d6374722c6165733235362d637472)(686d61632d6d64352c686d61632d736861312c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352d3936)(686d61632d6d64352c686d61632d736861312c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352d3936)(6e6f6e652c7a6c6962)(6e6f6e652c7a6c6962)()() ssh/(6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d73686131)(7373682d7273612c7373682d647373)(6165733132382d6362632c336465732d6362632c626c6f77666973682d6362632c636173743132382d6362632c617263666f75722c6165733139322d6362632c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733132382d6374722c6165733139322d6374722c6165733235362d637472)(6165733132382d6362632c336465732d6362632c626c6f77666973682d6362632c636173743132382d6362632c617263666f75722c6165733139322d6362632c6165733235362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73652c6165733132382d6374722c6165733139322d6374722c6165733235362d637472)(686d61632d6d64352c686d61632d736861312c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352d3936)(686d61632d6d64352c686d61632d736861312c686d61632d726970656d643136302c686d61632d726970656d64313630406f70656e7373682e636f6d2c686d61632d736861312d39362c686d61632d6d64352d3936)(6e6f6e652c7a6c6962)(6e6f6e652c7a6c6962)()()
11+
#close XXXX-XX-XX-XX-XX-XX

‎testing/Baseline/tests.ssh/ssh-ssh_kex_curve25519.log‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
2+
#separator \x09
3+
#set_separator ,
4+
#empty_field (empty)
5+
#unset_field -
6+
#path ssh
7+
#open XXXX-XX-XX-XX-XX-XX
8+
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version auth_success auth_attempts direction client server cipher_alg mac_alg compression_alg kex_alg host_key_alg host_key client_npf server_npf
9+
#types time string addr port addr port count bool count enum string string string string string string string string string string
10+
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.100 60906 192.168.1.32 22 2 T 2 - SSH-2.0-OpenSSH_7.4 SSH-2.0-OpenSSH_7.5 chacha20-poly1305@openssh.com hmac-sha2-512-etm@openssh.com none curve25519-sha256 ssh-ed25519-cert-v01@openssh.com e4:b1:8e:ca:6e:0e:e5:3c:7e:a4:0e:70:34:9d:b2:b1 ssh/(637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6578742d696e666f2d63)(7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392c7273612d736861322d3531322c7273612d736861322d3235362c7373682d7273612c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e69737470353231)(63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6362632c6165733139322d6362632c6165733235362d636263)(63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6362632c6165733139322d6362632c6165733235362d636263)(756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d73686131)(756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d73686131)(6e6f6e652c7a6c6962406f70656e7373682e636f6d2c7a6c6962)(6e6f6e652c7a6c6962406f70656e7373682e636f6d2c7a6c6962)()() ssh/(637572766532353531392d736861323536)(7373682d656432353531392c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d)(63686163686132302d706f6c7931333035406f70656e7373682e636f6d)(63686163686132302d706f6c7931333035406f70656e7373682e636f6d)(686d61632d736861322d3531322d65746d406f70656e7373682e636f6d)(686d61632d736861322d3531322d65746d406f70656e7373682e636f6d)(6e6f6e652c7a6c6962406f70656e7373682e636f6d)(6e6f6e652c7a6c6962406f70656e7373682e636f6d)()()
11+
#close XXXX-XX-XX-XX-XX-XX

‎testing/tests/ssh.zeek‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# @TEST-DOC: basic test verifying ssh.log
2+
# @TEST-EXEC: zeek -C -r $ZEEKTRACES/ssh/single-conn.trace $PACKAGE %INPUT
3+
# @TEST-EXEC: mv ssh.log ssh-single-conn.log
4+
# @TEST-EXEC: zeek -C -r $ZEEKTRACES/ssh/ssh_kex_curve25519.pcap $PACKAGE %INPUT
5+
# @TEST-EXEC: mv ssh.log ssh-ssh_kex_curve25519.log
6+
# @TEST-EXEC: btest-diff ssh-single-conn.log
7+
# @TEST-EXEC: btest-diff ssh-ssh_kex_curve25519.log
8+

0 commit comments

Comments
 (0)