Initial
This commit is contained in:
Patrick Kelley
commit
bd2d73ef4f
13
CMakeLists.txt
Normal file
13
CMakeLists.txt
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
|
||||||
|
cmake_minimum_required(VERSION 3.28.0-rc5 FATAL_ERROR)
|
||||||
|
|
||||||
|
project(Plugin)
|
||||||
|
|
||||||
|
include(ZeekPlugin)
|
||||||
|
|
||||||
|
zeek_plugin_begin(Zeek TDS)
|
||||||
|
zeek_plugin_cc(src/TDS.cc src/Plugin.cc)
|
||||||
|
zeek_plugin_bif(src/events.bif)
|
||||||
|
zeek_plugin_pac(src/tds.pac src/tds-analyzer.pac src/tds-protocol.pac)
|
||||||
|
zeek_plugin_dist_files(README CHANGES COPYING VERSION)
|
||||||
|
zeek_plugin_end()
|
||||||
4
CODE_OF_CONDUCT.md
Normal file
4
CODE_OF_CONDUCT.md
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
## Code of Conduct
|
||||||
|
This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
|
||||||
|
For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
|
||||||
|
opensource-codeofconduct@amazon.com with any additional questions or comments.
|
||||||
61
CONTRIBUTING.md
Normal file
61
CONTRIBUTING.md
Normal file
@ -0,0 +1,61 @@
|
|||||||
|
# Contributing Guidelines
|
||||||
|
|
||||||
|
Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional
|
||||||
|
documentation, we greatly value feedback and contributions from our community.
|
||||||
|
|
||||||
|
Please read through this document before submitting any issues or pull requests to ensure we have all the necessary
|
||||||
|
information to effectively respond to your bug report or contribution.
|
||||||
|
|
||||||
|
|
||||||
|
## Reporting Bugs/Feature Requests
|
||||||
|
|
||||||
|
We welcome you to use the GitHub issue tracker to report bugs or suggest features.
|
||||||
|
|
||||||
|
When filing an issue, please check [existing open](https://github.com/amzn/zeek-plugin-tds/issues), or [recently closed](https://github.com/amzn/zeek-plugin-tds/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aclosed%20), issues to make sure somebody else hasn't already
|
||||||
|
reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
|
||||||
|
|
||||||
|
* A reproducible test case or series of steps
|
||||||
|
* The version of our code being used
|
||||||
|
* Any modifications you've made relevant to the bug
|
||||||
|
* Anything unusual about your environment or deployment
|
||||||
|
|
||||||
|
|
||||||
|
## Contributing via Pull Requests
|
||||||
|
Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
|
||||||
|
|
||||||
|
1. You are working against the latest source on the *master* branch.
|
||||||
|
2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
|
||||||
|
3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
|
||||||
|
|
||||||
|
To send us a pull request, please:
|
||||||
|
|
||||||
|
1. Fork the repository.
|
||||||
|
2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.
|
||||||
|
3. Ensure local tests pass.
|
||||||
|
4. Commit to your fork using clear commit messages.
|
||||||
|
5. Send us a pull request, answering any default questions in the pull request interface.
|
||||||
|
6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.
|
||||||
|
|
||||||
|
GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
|
||||||
|
[creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
|
||||||
|
|
||||||
|
|
||||||
|
## Finding contributions to work on
|
||||||
|
Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any ['help wanted'](https://github.com/amzn/zeek-plugin-tds/labels/help%20wanted) issues is a great place to start.
|
||||||
|
|
||||||
|
|
||||||
|
## Code of Conduct
|
||||||
|
This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
|
||||||
|
For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
|
||||||
|
opensource-codeofconduct@amazon.com with any additional questions or comments.
|
||||||
|
|
||||||
|
|
||||||
|
## Security issue notifications
|
||||||
|
If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.
|
||||||
|
|
||||||
|
|
||||||
|
## Licensing
|
||||||
|
|
||||||
|
See the [LICENSE](https://github.com/amzn/zeek-plugin-tds/blob/master/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.
|
||||||
|
|
||||||
|
We may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes.
|
||||||
49
Dockerfile
Normal file
49
Dockerfile
Normal file
@ -0,0 +1,49 @@
|
|||||||
|
FROM public.ecr.aws/amazonlinux/amazonlinux:latest
|
||||||
|
MAINTAINER https://github.com/amzn/
|
||||||
|
|
||||||
|
# Metadata
|
||||||
|
LABEL program=zeek
|
||||||
|
|
||||||
|
# Specify program
|
||||||
|
ENV PROG zeek
|
||||||
|
# Specify source extension
|
||||||
|
ENV EXT tar.gz
|
||||||
|
# Specify Zeek version to download and install (e.g. 3.0.0)
|
||||||
|
ENV VERS 3.2.4
|
||||||
|
|
||||||
|
# Specify Cmake version
|
||||||
|
ENV CMAKEVERSMAIN 3.10
|
||||||
|
ENV CMAKEVERSSUB .0
|
||||||
|
|
||||||
|
# Install directory
|
||||||
|
ENV PREFIX /opt/zeek
|
||||||
|
# Path should include prefix
|
||||||
|
ENV PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PREFIX/bin
|
||||||
|
|
||||||
|
# Install dependencies
|
||||||
|
RUN yum -y update
|
||||||
|
RUN yum -y install cronie epel-release gcc gcc-c++ make libpcap-devel openssl-devel bind-devel zlib-devel git perl libcurl-devel GeoIP-devel python-devel jemalloc-devel swig libpcap bind-libs zlib bash python3 libcurl gawk GeoIP jemalloc wget flex bison python3-pip tar iproute procps-ng kernel-devel clang gdb && yum clean all
|
||||||
|
|
||||||
|
# Zeek 3.1.0 needs Cmake 3.0 or higher
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN wget https://cmake.org/files/v$CMAKEVERSMAIN/cmake-$CMAKEVERSMAIN$CMAKEVERSSUB.tar.gz
|
||||||
|
RUN tar -xvzf cmake-$CMAKEVERSMAIN$CMAKEVERSSUB.tar.gz
|
||||||
|
WORKDIR /tmp/cmake-$CMAKEVERSMAIN$CMAKEVERSSUB
|
||||||
|
RUN /tmp/cmake-$CMAKEVERSMAIN$CMAKEVERSSUB/bootstrap
|
||||||
|
RUN make -j$((`nproc`-1))
|
||||||
|
RUN make install
|
||||||
|
|
||||||
|
# Compile and install Zeek
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN wget https://old.zeek.org/downloads/$PROG-$VERS.$EXT && tar -xzf $PROG-$VERS.$EXT
|
||||||
|
WORKDIR /tmp/$PROG-$VERS
|
||||||
|
RUN ./configure --build-type=RelWithDebInfo --prefix=$PREFIX --disable-python
|
||||||
|
RUN make -j$((`nproc`-1))
|
||||||
|
RUN make install
|
||||||
|
|
||||||
|
USER root
|
||||||
|
RUN pip3 install zkg
|
||||||
|
RUN zkg autoconfig
|
||||||
|
COPY [--chown=bro:bro] . /tmp/zeek-plugin-tds
|
||||||
|
WORKDIR /tmp/zeek-plugin-tds
|
||||||
|
RUN zkg install --force .
|
||||||
23
LICENSE
Normal file
23
LICENSE
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
Copyright 2019 Amazon.com, Inc. or its affiliates. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions are met:
|
||||||
|
* Redistributions of source code must retain the above copyright
|
||||||
|
notice, this list of conditions and the following disclaimer.
|
||||||
|
* Redistributions in binary form must reproduce the above copyright
|
||||||
|
notice, this list of conditions and the following disclaimer in the
|
||||||
|
documentation and/or other materials provided with the distribution.
|
||||||
|
* Neither the name of the copyright holder nor the
|
||||||
|
names of its contributors may be used to endorse or promote products
|
||||||
|
derived from this software without specific prior written permission.
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
||||||
|
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||||
|
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||||
|
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE FOR ANY
|
||||||
|
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||||
|
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||||
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
||||||
|
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||||
|
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||||
|
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
29
Makefile
Normal file
29
Makefile
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
#
|
||||||
|
# Convenience Makefile providing a few common top-level targets.
|
||||||
|
#
|
||||||
|
|
||||||
|
cmake_build_dir=build
|
||||||
|
arch=`uname -s | tr A-Z a-z`-`uname -m`
|
||||||
|
|
||||||
|
all: build-it
|
||||||
|
|
||||||
|
build-it:
|
||||||
|
@test -e $(cmake_build_dir)/config.status || ./configure
|
||||||
|
-@test -e $(cmake_build_dir)/CMakeCache.txt && \
|
||||||
|
test $(cmake_build_dir)/CMakeCache.txt -ot `cat $(cmake_build_dir)/CMakeCache.txt | grep ZEEK_DIST | cut -d '=' -f 2`/build/CMakeCache.txt && \
|
||||||
|
echo Updating stale CMake cache && \
|
||||||
|
touch $(cmake_build_dir)/CMakeCache.txt
|
||||||
|
|
||||||
|
( cd $(cmake_build_dir) && make )
|
||||||
|
|
||||||
|
install:
|
||||||
|
( cd $(cmake_build_dir) && make install )
|
||||||
|
|
||||||
|
clean:
|
||||||
|
( cd $(cmake_build_dir) && make clean )
|
||||||
|
|
||||||
|
distclean:
|
||||||
|
rm -rf $(cmake_build_dir)
|
||||||
|
|
||||||
|
test:
|
||||||
|
if [ -f build/lib/Zeek-* ]; then make -C tests; else echo "Plugin not built."; fi
|
||||||
11
README.md
Normal file
11
README.md
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
## Zeek Plugin TDS
|
||||||
|
|
||||||
|
When running as part of your Zeek installation this plugin will produce three log files containing metadata extracted from any [Tabular Data Stream](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/b46a581a-39de-4745-b076-ec4dbb7d13ec) (TDS) traffic observed on TCP port 1433.
|
||||||
|
|
||||||
|
## Installation and Usage
|
||||||
|
|
||||||
|
`zeek-plugin-tds` is distributed as a Zeek package and is compatible with the [`zkg`](https://docs.zeek.org/projects/package-manager/en/stable/zkg.html) command line tool.
|
||||||
|
|
||||||
|
## Sharing and Contributing
|
||||||
|
|
||||||
|
This code is made available under the [BSD-3-Clause license](https://github.com/amzn/zeek-plugin-tds/blob/master/LICENSE). [Guidelines for contributing](https://github.com/amzn/zeek-plugin-tds/blob/master/CONTRIBUTING.md) are available as well as a [pull request template](https://github.com/amzn/zeek-plugin-tds/blob/master/.github/PULL_REQUEST_TEMPLATE.md). A [Dockerfile](https://github.com/amzn/zeek-plugin-tds/blob/master/Dockerfile) has been included in the repository to assist with setting up an environment for testing any changes to the plugin.
|
||||||
188
configure
vendored
Executable file
188
configure
vendored
Executable file
@ -0,0 +1,188 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
#
|
||||||
|
# Wrapper for viewing/setting options that the plugin's CMake
|
||||||
|
# scripts will recognize.
|
||||||
|
#
|
||||||
|
# Don't edit this. Edit configure.plugin to add plugin-specific options.
|
||||||
|
#
|
||||||
|
|
||||||
|
set -e
|
||||||
|
command="$0 $*"
|
||||||
|
|
||||||
|
if [ -e `dirname $0`/configure.plugin ]; then
|
||||||
|
# Include custom additions.
|
||||||
|
. `dirname $0`/configure.plugin
|
||||||
|
fi
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
|
||||||
|
cat 1>&2 <<EOF
|
||||||
|
Usage: $0 [OPTIONS]
|
||||||
|
|
||||||
|
Plugin Options:
|
||||||
|
--cmake=PATH Path to CMake binary
|
||||||
|
--zeek-dist=DIR Path to Zeek source tree
|
||||||
|
--install-root=DIR Path where to install plugin into
|
||||||
|
--with-binpac=DIR Path to BinPAC installation root
|
||||||
|
--with-broker=DIR Path to Broker installation root
|
||||||
|
--with-caf=DIR Path to CAF installation root
|
||||||
|
--with-bifcl=PATH Path to bifcl executable
|
||||||
|
--enable-debug Compile in debugging mode
|
||||||
|
EOF
|
||||||
|
|
||||||
|
if type plugin_usage >/dev/null 2>&1; then
|
||||||
|
plugin_usage 1>&2
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to append a CMake cache entry definition to the
|
||||||
|
# CMakeCacheEntries variable
|
||||||
|
# $1 is the cache entry variable name
|
||||||
|
# $2 is the cache entry variable type
|
||||||
|
# $3 is the cache entry variable value
|
||||||
|
append_cache_entry () {
|
||||||
|
CMakeCacheEntries="$CMakeCacheEntries -D $1:$2=$3"
|
||||||
|
}
|
||||||
|
|
||||||
|
# set defaults
|
||||||
|
builddir=build
|
||||||
|
zeekdist=""
|
||||||
|
installroot="default"
|
||||||
|
CMakeCacheEntries=""
|
||||||
|
|
||||||
|
while [ $# -ne 0 ]; do
|
||||||
|
case "$1" in
|
||||||
|
-*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
|
||||||
|
*) optarg= ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
case "$1" in
|
||||||
|
--help|-h)
|
||||||
|
usage
|
||||||
|
;;
|
||||||
|
|
||||||
|
--cmake=*)
|
||||||
|
CMakeCommand=$optarg
|
||||||
|
;;
|
||||||
|
|
||||||
|
--zeek-dist=*)
|
||||||
|
zeekdist=`cd $optarg && pwd`
|
||||||
|
;;
|
||||||
|
|
||||||
|
--install-root=*)
|
||||||
|
installroot=$optarg
|
||||||
|
;;
|
||||||
|
|
||||||
|
--with-binpac=*)
|
||||||
|
append_cache_entry BinPAC_ROOT_DIR PATH $optarg
|
||||||
|
binpac_root=$optarg
|
||||||
|
;;
|
||||||
|
|
||||||
|
--with-broker=*)
|
||||||
|
append_cache_entry BROKER_ROOT_DIR PATH $optarg
|
||||||
|
broker_root=$optarg
|
||||||
|
;;
|
||||||
|
|
||||||
|
--with-caf=*)
|
||||||
|
append_cache_entry CAF_ROOT_DIR PATH $optarg
|
||||||
|
caf_root=$optarg
|
||||||
|
;;
|
||||||
|
|
||||||
|
--with-bifcl=*)
|
||||||
|
append_cache_entry BifCl_EXE PATH $optarg
|
||||||
|
;;
|
||||||
|
|
||||||
|
--enable-debug)
|
||||||
|
append_cache_entry BRO_PLUGIN_ENABLE_DEBUG BOOL true
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
if type plugin_option >/dev/null 2>&1; then
|
||||||
|
plugin_option $1 && shift && continue;
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Invalid option '$1'. Try $0 --help to see available options."
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ -z "$CMakeCommand" ]; then
|
||||||
|
# prefer cmake3 over "regular" cmake (cmake == cmake2 on RHEL)
|
||||||
|
if command -v cmake3 >/dev/null 2>&1 ; then
|
||||||
|
CMakeCommand="cmake3"
|
||||||
|
elif command -v cmake >/dev/null 2>&1 ; then
|
||||||
|
CMakeCommand="cmake"
|
||||||
|
else
|
||||||
|
echo "This package requires CMake, please install it first."
|
||||||
|
echo "Then you may use this script to configure the CMake build."
|
||||||
|
echo "Note: pass --cmake=PATH to use cmake in non-standard locations."
|
||||||
|
exit 1;
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$zeekdist" ]; then
|
||||||
|
if type zeek-config >/dev/null 2>&1; then
|
||||||
|
zeek_config="zeek-config"
|
||||||
|
else
|
||||||
|
echo "Either 'zeek-config' must be in PATH or '--zeek-dist=<path>' used"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
append_cache_entry BRO_CONFIG_PREFIX PATH `${zeek_config} --prefix`
|
||||||
|
append_cache_entry BRO_CONFIG_INCLUDE_DIR PATH `${zeek_config} --include_dir`
|
||||||
|
append_cache_entry BRO_CONFIG_PLUGIN_DIR PATH `${zeek_config} --plugin_dir`
|
||||||
|
append_cache_entry BRO_CONFIG_CMAKE_DIR PATH `${zeek_config} --cmake_dir`
|
||||||
|
append_cache_entry CMAKE_MODULE_PATH PATH `${zeek_config} --cmake_dir`
|
||||||
|
|
||||||
|
build_type=`${zeek_config} --build_type`
|
||||||
|
|
||||||
|
if [ "$build_type" = "debug" ]; then
|
||||||
|
append_cache_entry BRO_PLUGIN_ENABLE_DEBUG BOOL true
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$binpac_root" ]; then
|
||||||
|
append_cache_entry BinPAC_ROOT_DIR PATH `${zeek_config} --binpac_root`
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$broker_root" ]; then
|
||||||
|
append_cache_entry BROKER_ROOT_DIR PATH `${zeek_config} --broker_root`
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$caf_root" ]; then
|
||||||
|
append_cache_entry CAF_ROOT_DIR PATH `${zeek_config} --caf_root`
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
if [ ! -e "$zeekdist/zeek-path-dev.in" ]; then
|
||||||
|
echo "$zeekdist does not appear to be a valid Zeek source tree."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# BRO_DIST is the canonical/historical name used by plugin CMake scripts
|
||||||
|
# ZEEK_DIST doesn't serve a function at the moment, but set/provided anyway
|
||||||
|
append_cache_entry BRO_DIST PATH $zeekdist
|
||||||
|
append_cache_entry ZEEK_DIST PATH $zeekdist
|
||||||
|
append_cache_entry CMAKE_MODULE_PATH PATH $zeekdist/cmake
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$installroot" != "default" ]; then
|
||||||
|
mkdir -p $installroot
|
||||||
|
append_cache_entry BRO_PLUGIN_INSTALL_ROOT PATH $installroot
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Build Directory : $builddir"
|
||||||
|
echo "Zeek Source Directory : $zeekdist"
|
||||||
|
|
||||||
|
mkdir -p $builddir
|
||||||
|
cd $builddir
|
||||||
|
|
||||||
|
"$CMakeCommand" $CMakeCacheEntries ..
|
||||||
|
|
||||||
|
echo "# This is the command used to configure this build" > config.status
|
||||||
|
echo $command >> config.status
|
||||||
|
chmod u+x config.status
|
||||||
26
configure.plugin
Normal file
26
configure.plugin
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
#
|
||||||
|
# Hooks to add custom options to the configure script.
|
||||||
|
#
|
||||||
|
|
||||||
|
plugin_usage()
|
||||||
|
{
|
||||||
|
: # Do nothing
|
||||||
|
# cat <<EOF
|
||||||
|
# --with-foo=DIR Path to foo
|
||||||
|
# EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
plugin_option()
|
||||||
|
{
|
||||||
|
case "$1" in
|
||||||
|
# --with-foo=*)
|
||||||
|
# append_cache_entry FOO_DIR PATH $optarg
|
||||||
|
# return 0
|
||||||
|
# ;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
return 1;
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
3
scripts/TDS/__load__.zeek
Normal file
3
scripts/TDS/__load__.zeek
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
@load ./consts.zeek
|
||||||
|
@load ./main.zeek
|
||||||
|
|
||||||
30
scripts/TDS/consts.zeek
Normal file
30
scripts/TDS/consts.zeek
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
## Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||||
|
## SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
module TDS;
|
||||||
|
|
||||||
|
export {
|
||||||
|
## TDS default commands
|
||||||
|
const commands = {
|
||||||
|
[0x00] = "NOP",
|
||||||
|
[0x01] = "SQL Batch",
|
||||||
|
[0x02] = "Pre TDS7 Login",
|
||||||
|
[0x03] = "Remote Procedure Call",
|
||||||
|
[0x04] = "SQL Batch Server Response",
|
||||||
|
[0x05] = "Unused",
|
||||||
|
[0x06] = "Attention Request",
|
||||||
|
[0x07] = "Bulk Load Data",
|
||||||
|
[0x0E] = "Transcation Manager Request",
|
||||||
|
[0x0F] = "TDS5 Query",
|
||||||
|
[0x10] = "TDS7 Login",
|
||||||
|
[0x11] = "SSPI Message",
|
||||||
|
[0x12] = "Pre-Login Request",
|
||||||
|
} &default=function(i: count):string { return fmt("command (%d)", i); } &redef;
|
||||||
|
|
||||||
|
## TDS header types
|
||||||
|
const header_types = {
|
||||||
|
[0x0000] = "NOP",
|
||||||
|
[0x0001] = "Query notifications",
|
||||||
|
[0x0002] = "Transaction Descriptor",
|
||||||
|
} &default=function(i: count):string { return fmt("command (%d)", i); } &redef;
|
||||||
|
}
|
||||||
217
scripts/TDS/main.zeek
Normal file
217
scripts/TDS/main.zeek
Normal file
@ -0,0 +1,217 @@
|
|||||||
|
##! Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||||
|
##! SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
##! Implements base functionality for TDS analysis.
|
||||||
|
##! Generates the tds.log file, containing some information about the TDS headers.
|
||||||
|
##! Generates the tds_rpc.log file, containing some information about rpc data.
|
||||||
|
##! Generates the tds_sql_batch.log file, containing some information about sql batch data.
|
||||||
|
|
||||||
|
module TDS;
|
||||||
|
|
||||||
|
export {
|
||||||
|
redef enum Log::ID += {
|
||||||
|
Log_TDS,
|
||||||
|
Log_TDS_RPC,
|
||||||
|
Log_TDS_SQL_Batch
|
||||||
|
};
|
||||||
|
|
||||||
|
## header info
|
||||||
|
type TDS: record {
|
||||||
|
ts : time &log; ## Timestamp for when the event happened.
|
||||||
|
uid : string &log; ## Unique ID for the connection.
|
||||||
|
id : conn_id &log; ## The connection's 4-tuple of endpoint addresses/ports.
|
||||||
|
|
||||||
|
command : string &optional &log; ## Name of the sent TDS command.
|
||||||
|
};
|
||||||
|
## Event that can be handled to access the tds record as it is sent to the loggin framework.
|
||||||
|
global log_tds: event(rec: TDS);
|
||||||
|
|
||||||
|
## Remote Procedure Call
|
||||||
|
type TDS_RPC: record {
|
||||||
|
ts : time &log; ## Timestamp for when the event happened.
|
||||||
|
uid : string &log; ## Unique ID for the connection.
|
||||||
|
id : conn_id &log; ## The connection's 4-tuple of endpoint addresses/ports.
|
||||||
|
|
||||||
|
procedure_name : string &optional &log;
|
||||||
|
parameters : string_vec &optional &log;
|
||||||
|
};
|
||||||
|
## Event that can be handled to access the tds record as it is sent to the loggin framework.
|
||||||
|
global log_tds_rpc: event(rec: TDS_RPC);
|
||||||
|
|
||||||
|
## SQL Batch
|
||||||
|
type TDS_SQL_Batch: record {
|
||||||
|
ts : time &log; ## Timestamp for when the event happened.
|
||||||
|
uid : string &log; ## Unique ID for the connection.
|
||||||
|
id : conn_id &log; ## The connection's 4-tuple of endpoint addresses/ports.
|
||||||
|
|
||||||
|
header_type : string &optional &log;
|
||||||
|
query : string &optional &log;
|
||||||
|
};
|
||||||
|
## Event that can be handled to access the tds record as it is sent to the loggin framework.
|
||||||
|
global log_tds_sql_batch: event(rec: TDS_SQL_Batch);
|
||||||
|
}
|
||||||
|
|
||||||
|
redef record connection += {
|
||||||
|
tds : TDS &optional;
|
||||||
|
tds_rpc : TDS_RPC &optional;
|
||||||
|
tds_sql_batch : TDS_SQL_Batch &optional;
|
||||||
|
};
|
||||||
|
|
||||||
|
## define listening ports
|
||||||
|
const ports = {
|
||||||
|
1433/tcp
|
||||||
|
};
|
||||||
|
redef likely_server_ports += {
|
||||||
|
ports
|
||||||
|
};
|
||||||
|
|
||||||
|
event zeek_init() &priority=5 {
|
||||||
|
Log::create_stream(TDS::Log_TDS,
|
||||||
|
[$columns=TDS,
|
||||||
|
$ev=log_tds,
|
||||||
|
$path="tds"]);
|
||||||
|
Log::create_stream(TDS::Log_TDS_RPC,
|
||||||
|
[$columns=TDS_RPC,
|
||||||
|
$ev=log_tds_rpc,
|
||||||
|
$path="tds_rpc"]);
|
||||||
|
Log::create_stream(TDS::Log_TDS_SQL_Batch,
|
||||||
|
[$columns=TDS_SQL_Batch,
|
||||||
|
$ev=log_tds_sql_batch,
|
||||||
|
$path="tds_sql_batch"]);
|
||||||
|
Analyzer::register_for_ports(Analyzer::ANALYZER_TDS, ports);
|
||||||
|
}
|
||||||
|
|
||||||
|
##! general tds header
|
||||||
|
event tds(c: connection, is_orig: bool, command: count) {
|
||||||
|
if(!c?$tds) {
|
||||||
|
c$tds = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||||
|
}
|
||||||
|
|
||||||
|
c$tds$ts = network_time();
|
||||||
|
c$tds$command = commands[command];
|
||||||
|
|
||||||
|
Log::write(Log_TDS, c$tds);
|
||||||
|
delete c$tds;
|
||||||
|
}
|
||||||
|
|
||||||
|
##! general tds rpc
|
||||||
|
event tds_rpc(c: connection, is_orig: bool,
|
||||||
|
procedure_name: string,
|
||||||
|
parameters: string) {
|
||||||
|
if(!c?$tds_rpc) {
|
||||||
|
c$tds_rpc = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||||
|
}
|
||||||
|
|
||||||
|
c$tds_rpc$ts = network_time();
|
||||||
|
c$tds_rpc$procedure_name = subst_string(procedure_name, "\x00", "");
|
||||||
|
local params_size: count = |parameters|;
|
||||||
|
if (params_size > 0) {
|
||||||
|
local params: string_vec;
|
||||||
|
local params_index: count=0;
|
||||||
|
local param_index: count=0;
|
||||||
|
local param_name: string="";
|
||||||
|
local param_type: count=0;
|
||||||
|
local param_data: string;
|
||||||
|
local param_len: count=0;
|
||||||
|
while (param_index < params_size) {
|
||||||
|
param_len = bytestring_to_count(parameters[param_index])*2;
|
||||||
|
param_index += 1;
|
||||||
|
param_name = subst_string(parameters[param_index: param_index+param_len], "\x00", "");
|
||||||
|
param_index += param_len;
|
||||||
|
param_index += 1; ##! status
|
||||||
|
param_type = bytestring_to_count(parameters[param_index]);
|
||||||
|
param_index += 1;
|
||||||
|
param_data = "";
|
||||||
|
switch (param_type) {
|
||||||
|
case 0x24, ##! GUID
|
||||||
|
0x26, ##! int
|
||||||
|
0x68, ##! bit
|
||||||
|
0x6d, ##! float
|
||||||
|
0x6f: ##! DateTime
|
||||||
|
param_index += 1; ##! max length
|
||||||
|
param_len = bytestring_to_count(parameters[param_index]);
|
||||||
|
param_index += 1;
|
||||||
|
switch (param_type) {
|
||||||
|
case 0x24: ##! GUID
|
||||||
|
param_data = bytestring_to_hexstr(parameters[param_index+3]);
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+2]);
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+1]);
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index]);
|
||||||
|
param_data += "-";
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+5]);
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+4]);
|
||||||
|
param_data += "-";
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+7]);
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+6]);
|
||||||
|
param_data += "-";
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+8:param_index+10]);
|
||||||
|
param_data += "-";
|
||||||
|
param_data += bytestring_to_hexstr(parameters[param_index+10:param_index+param_len]);
|
||||||
|
break;
|
||||||
|
case 0x68: ##! bit
|
||||||
|
if (bytestring_to_count(parameters[param_index]) == 1) {
|
||||||
|
param_data = "True";
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
param_data = "False";
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case 0x6d: ##! float
|
||||||
|
param_data = fmt("%f", bytestring_to_double(parameters[param_index:param_index+param_len]));
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
if (param_index >= params_size) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
param_data = fmt("%d", bytestring_to_count(parameters[param_index:param_index+param_len], T));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
param_index += param_len;
|
||||||
|
params[params_index] = fmt("%s=%s", param_name, param_data);
|
||||||
|
params_index += 1;
|
||||||
|
break;
|
||||||
|
case 0xa7, ##! VarChar
|
||||||
|
0xe7: ##! NVarChar
|
||||||
|
param_index += 2; ##! max length
|
||||||
|
param_index += 5; ##! collation
|
||||||
|
param_len = bytestring_to_count(parameters[param_index:param_index+2], T);
|
||||||
|
param_index += 2;
|
||||||
|
##! NULL is 65535
|
||||||
|
if (param_len > 0 && param_len < 65535) {
|
||||||
|
param_data = subst_string(parameters[param_index:param_index+param_len], "\x00", "");
|
||||||
|
param_index += param_len;
|
||||||
|
}
|
||||||
|
params[params_index] = fmt("%s=%s", param_name, param_data);
|
||||||
|
params_index += 1;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
c$tds_rpc$parameters = params;
|
||||||
|
}
|
||||||
|
|
||||||
|
Log::write(Log_TDS_RPC, c$tds_rpc);
|
||||||
|
delete c$tds_rpc;
|
||||||
|
}
|
||||||
|
|
||||||
|
event tds_sql_batch(c: connection, is_orig: bool,
|
||||||
|
header_type: count,
|
||||||
|
query: string) {
|
||||||
|
if(!c?$tds_sql_batch) {
|
||||||
|
c$tds_sql_batch = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||||
|
}
|
||||||
|
|
||||||
|
c$tds_sql_batch$ts = network_time();
|
||||||
|
c$tds_sql_batch$header_type = header_types[header_type];
|
||||||
|
query = subst_string(query, "\x00", "");
|
||||||
|
c$tds_sql_batch$query = query;
|
||||||
|
|
||||||
|
Log::write(Log_TDS_SQL_Batch, c$tds_sql_batch);
|
||||||
|
delete c$tds_sql_batch;
|
||||||
|
}
|
||||||
|
|
||||||
|
event connection_state_remove(c: connection) &priority=-5 {
|
||||||
|
if(c?$tds) {
|
||||||
|
delete c$tds;
|
||||||
|
}
|
||||||
|
}
|
||||||
19
src/Plugin.cc
Normal file
19
src/Plugin.cc
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
#include "Plugin.h"
|
||||||
|
#include "zeek/analyzer/Component.h"
|
||||||
|
|
||||||
|
namespace plugin {
|
||||||
|
namespace Zeek_TDS {
|
||||||
|
Plugin plugin;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
using namespace plugin::Zeek_TDS;
|
||||||
|
|
||||||
|
zeek::plugin::Configuration Plugin::Configure() {
|
||||||
|
AddComponent(new zeek::analyzer::Component("TDS", analyzer::tds::TDS_Analyzer::Instantiate));
|
||||||
|
|
||||||
|
zeek::plugin::Configuration config;
|
||||||
|
config.name = "Zeek::TDS";
|
||||||
|
config.description = "MS-SQL TDS protocol analyzer";
|
||||||
|
return config;
|
||||||
|
}
|
||||||
19
src/Plugin.h
Normal file
19
src/Plugin.h
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
#ifndef ZEEK_PLUGIN_ZEEK_TDS
|
||||||
|
#define ZEEK_PLUGIN_ZEEK_TDS
|
||||||
|
|
||||||
|
#include <zeek/plugin/Plugin.h>
|
||||||
|
#include "TDS.h"
|
||||||
|
|
||||||
|
namespace plugin {
|
||||||
|
namespace Zeek_TDS {
|
||||||
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
|
protected:
|
||||||
|
// Overridden from plugin::Plugin.
|
||||||
|
virtual zeek::plugin::Configuration Configure();
|
||||||
|
};
|
||||||
|
|
||||||
|
extern Plugin plugin;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif
|
||||||
50
src/TDS.cc
Normal file
50
src/TDS.cc
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
#include "TDS.h"
|
||||||
|
#include <zeek/analyzer/protocol/tcp/TCP_Reassembler.h>
|
||||||
|
#include <zeek/Reporter.h>
|
||||||
|
#include "events.bif.h"
|
||||||
|
|
||||||
|
using namespace analyzer::tds;
|
||||||
|
|
||||||
|
TDS_Analyzer::TDS_Analyzer(zeek::Connection* c): zeek::analyzer::tcp::TCP_ApplicationAnalyzer("TDS", c) {
|
||||||
|
interp = new binpac::TDS::TDS_Conn(this);
|
||||||
|
had_gap = false;
|
||||||
|
}
|
||||||
|
|
||||||
|
TDS_Analyzer::~TDS_Analyzer() {
|
||||||
|
delete interp;
|
||||||
|
}
|
||||||
|
|
||||||
|
void TDS_Analyzer::Done() {
|
||||||
|
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::Done();
|
||||||
|
interp->FlowEOF(true);
|
||||||
|
interp->FlowEOF(false);
|
||||||
|
}
|
||||||
|
|
||||||
|
void TDS_Analyzer::EndpointEOF(bool is_orig) {
|
||||||
|
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
|
||||||
|
interp->FlowEOF(is_orig);
|
||||||
|
}
|
||||||
|
|
||||||
|
void TDS_Analyzer::DeliverStream(int len, const u_char* data, bool orig) {
|
||||||
|
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
|
||||||
|
assert(TCP());
|
||||||
|
//if(TCP()->IsPartial())
|
||||||
|
// return;
|
||||||
|
// If only one side had a content gap, we could still try to
|
||||||
|
// deliver data to the other side if the script layer can handle this.
|
||||||
|
if(had_gap)
|
||||||
|
return;
|
||||||
|
|
||||||
|
try {
|
||||||
|
interp->NewData(orig, data, data + len);
|
||||||
|
}
|
||||||
|
catch(const binpac::Exception& e) {
|
||||||
|
AnalyzerViolation(zeek::util::fmt("Binpac exception: %s", e.c_msg()));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void TDS_Analyzer::Undelivered(uint64_t seq, int len, bool orig) {
|
||||||
|
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
||||||
|
had_gap = true;
|
||||||
|
interp->NewGap(orig, len);
|
||||||
|
}
|
||||||
31
src/TDS.h
Normal file
31
src/TDS.h
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
#ifndef ANALYZER_PROTOCOL_TDS_H
|
||||||
|
#define ANALYZER_PROTOCOL_TDS_H
|
||||||
|
|
||||||
|
#include <zeek/analyzer/protocol/tcp/TCP.h>
|
||||||
|
#include "tds_pac.h"
|
||||||
|
|
||||||
|
namespace analyzer {
|
||||||
|
namespace tds {
|
||||||
|
class TDS_Analyzer : public zeek::analyzer::tcp::TCP_ApplicationAnalyzer {
|
||||||
|
public:
|
||||||
|
TDS_Analyzer(zeek::Connection* conn);
|
||||||
|
virtual ~TDS_Analyzer();
|
||||||
|
|
||||||
|
virtual void Done();
|
||||||
|
virtual void DeliverStream(int len, const u_char* data, bool orig);
|
||||||
|
virtual void Undelivered(uint64_t seq, int len, bool orig);
|
||||||
|
|
||||||
|
virtual void EndpointEOF(bool is_orig);
|
||||||
|
|
||||||
|
static zeek::analyzer::Analyzer* Instantiate(zeek::Connection* conn) {
|
||||||
|
return new TDS_Analyzer(conn);
|
||||||
|
}
|
||||||
|
|
||||||
|
protected:
|
||||||
|
binpac::TDS::TDS_Conn* interp;
|
||||||
|
bool had_gap;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif
|
||||||
40
src/events.bif
Normal file
40
src/events.bif
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
## Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||||
|
## SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
######################################
|
||||||
|
## Generated for all the TDS headers #
|
||||||
|
######################################
|
||||||
|
## c: The connection the TDS communication is part of.
|
||||||
|
## is_orig: True if this reflects originator-side activity.
|
||||||
|
## command: uint16 of either request/response
|
||||||
|
## index: index# of the packet.
|
||||||
|
##
|
||||||
|
event tds%(c: connection, is_orig: bool,
|
||||||
|
command: count
|
||||||
|
%);
|
||||||
|
|
||||||
|
############################################
|
||||||
|
## Generated for the remote procedure call #
|
||||||
|
############################################
|
||||||
|
## c: The connection the TDS communication is part of.
|
||||||
|
## is_orig: True if this reflects originator-side activity.
|
||||||
|
## product_name: product name.
|
||||||
|
## serial_number: serial number.
|
||||||
|
##
|
||||||
|
event tds_rpc%(c: connection, is_orig: bool,
|
||||||
|
procedure_name: string,
|
||||||
|
parameters: string
|
||||||
|
%);
|
||||||
|
|
||||||
|
####################################
|
||||||
|
## Generated for the identity info #
|
||||||
|
####################################
|
||||||
|
## c: The connection the TDS communication is part of.
|
||||||
|
## is_orig: True if this reflects originator-side activity.
|
||||||
|
## product_name: product name.
|
||||||
|
## serial_number: serial number.
|
||||||
|
##
|
||||||
|
event tds_sql_batch%(c: connection, is_orig: bool,
|
||||||
|
header_type: count,
|
||||||
|
query: string
|
||||||
|
%);
|
||||||
101
src/tds-analyzer.pac
Normal file
101
src/tds-analyzer.pac
Normal file
@ -0,0 +1,101 @@
|
|||||||
|
## Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||||
|
## SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
connection TDS_Conn(zeek_analyzer: ZeekAnalyzer) {
|
||||||
|
upflow = TDS_Flow(true);
|
||||||
|
downflow = TDS_Flow(false);
|
||||||
|
};
|
||||||
|
|
||||||
|
%header{
|
||||||
|
#define SQL_BATCH 0x01
|
||||||
|
#define PRE_TDS7_LOGIN 0x02
|
||||||
|
#define REMOTE_PROCEDURE_CALL 0x03
|
||||||
|
#define RESPONSE 0x04
|
||||||
|
#define UNUSED 0x05
|
||||||
|
#define ATTENTION_REQUEST 0x06
|
||||||
|
#define BULK_LOAD_DATA 0x07
|
||||||
|
#define TRANSACTION_MANAGER 0x0e
|
||||||
|
#define TDS5_QUERY 0x0F
|
||||||
|
#define TDS7_LOGIN 0x10
|
||||||
|
#define SSPI_MESSAGE 0x11
|
||||||
|
#define TDS7_PRELOGIN 0x12
|
||||||
|
|
||||||
|
#define QUERY_NOTIFICATIONS 0x0001
|
||||||
|
#define TRANSACTION_DESCRIPTOR 0x0002
|
||||||
|
%}
|
||||||
|
|
||||||
|
flow TDS_Flow(is_orig: bool) {
|
||||||
|
# flowunit ?
|
||||||
|
datagram = TDS_PDU(is_orig) withcontext(connection, this);
|
||||||
|
|
||||||
|
function tds(header: TDS): bool %{
|
||||||
|
if(::tds) {
|
||||||
|
if (${header.command} != SQL_BATCH &&
|
||||||
|
${header.command} != PRE_TDS7_LOGIN &&
|
||||||
|
${header.command} != REMOTE_PROCEDURE_CALL &&
|
||||||
|
${header.command} != RESPONSE &&
|
||||||
|
${header.command} != UNUSED &&
|
||||||
|
${header.command} != ATTENTION_REQUEST &&
|
||||||
|
${header.command} != BULK_LOAD_DATA &&
|
||||||
|
${header.command} != TRANSACTION_MANAGER &&
|
||||||
|
${header.command} != TDS5_QUERY &&
|
||||||
|
${header.command} != TDS7_LOGIN &&
|
||||||
|
${header.command} != SSPI_MESSAGE &&
|
||||||
|
${header.command} != TDS7_PRELOGIN) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
connection()->zeek_analyzer()->AnalyzerConfirmation();
|
||||||
|
zeek::BifEvent::enqueue_tds(connection()->zeek_analyzer(),
|
||||||
|
connection()->zeek_analyzer()->Conn(),
|
||||||
|
is_orig(),
|
||||||
|
${header.command}
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
%}
|
||||||
|
|
||||||
|
function tds_rpc(rpc: TDS_RPC): bool %{
|
||||||
|
if(::tds_rpc) {
|
||||||
|
connection()->zeek_analyzer()->AnalyzerConfirmation();
|
||||||
|
zeek::BifEvent::enqueue_tds_rpc(connection()->zeek_analyzer(),
|
||||||
|
connection()->zeek_analyzer()->Conn(),
|
||||||
|
is_orig(),
|
||||||
|
to_stringval(${rpc.procedure_name}),
|
||||||
|
to_stringval(${rpc.parameters})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
%}
|
||||||
|
|
||||||
|
function tds_sql_batch(sqlBatch: TDS_SQL_BATCH): bool %{
|
||||||
|
if(::tds_sql_batch) {
|
||||||
|
if (${sqlBatch.stream_header.header_type} != QUERY_NOTIFICATIONS &&
|
||||||
|
${sqlBatch.stream_header.header_type} != TRANSACTION_DESCRIPTOR) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
connection()->zeek_analyzer()->AnalyzerConfirmation();
|
||||||
|
zeek::BifEvent::enqueue_tds_sql_batch(connection()->zeek_analyzer(),
|
||||||
|
connection()->zeek_analyzer()->Conn(),
|
||||||
|
is_orig(),
|
||||||
|
${sqlBatch.stream_header.header_type},
|
||||||
|
to_stringval(${sqlBatch.query})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
%}
|
||||||
|
};
|
||||||
|
|
||||||
|
refine typeattr TDS += &let {
|
||||||
|
tds: bool = $context.flow.tds(this);
|
||||||
|
};
|
||||||
|
|
||||||
|
refine typeattr TDS_RPC += &let {
|
||||||
|
tds_rpc: bool = $context.flow.tds_rpc(this);
|
||||||
|
};
|
||||||
|
|
||||||
|
refine typeattr TDS_SQL_BATCH += &let {
|
||||||
|
tds_sql_batch: bool = $context.flow.tds_sql_batch(this);
|
||||||
|
};
|
||||||
92
src/tds-protocol.pac
Normal file
92
src/tds-protocol.pac
Normal file
@ -0,0 +1,92 @@
|
|||||||
|
## Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||||
|
## SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
#
|
||||||
|
# Binpac for Microsoft TDS analyser.
|
||||||
|
# More information from https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/b46a581a-39de-4745-b076-ec4dbb7d13ec
|
||||||
|
#
|
||||||
|
|
||||||
|
##############################
|
||||||
|
# CONSTANTS #
|
||||||
|
##############################
|
||||||
|
|
||||||
|
enum cmd_codes {
|
||||||
|
SQL_BATCH = 0x01,
|
||||||
|
PRE_TDS7_LOGIN = 0x02,
|
||||||
|
REMOTE_PROCEDURE_CALL = 0x03,
|
||||||
|
RESPONSE = 0x04,
|
||||||
|
UNUSED = 0x05,
|
||||||
|
ATTENTION_REQUEST = 0x06,
|
||||||
|
BULK_LOAD_DATA = 0x07,
|
||||||
|
TRANSACTION_MANAGER = 0x0e,
|
||||||
|
TDS5_QUERY = 0x0F,
|
||||||
|
TDS7_LOGIN = 0x10,
|
||||||
|
SSPI_MESSAGE = 0x11,
|
||||||
|
TDS7_PRELOGIN = 0x12
|
||||||
|
};
|
||||||
|
|
||||||
|
##############################
|
||||||
|
## RECORD TYPES #
|
||||||
|
##############################
|
||||||
|
|
||||||
|
## All multiple byte fields are set in little endian order
|
||||||
|
## Packets are set in big endian order
|
||||||
|
|
||||||
|
type TDS_PDU(is_orig: bool) = case is_orig of {
|
||||||
|
true -> request : TDS_Request;
|
||||||
|
false -> response : TDS_Response;
|
||||||
|
} &byteorder=bigendian;
|
||||||
|
|
||||||
|
# switch for the request portion
|
||||||
|
type TDS_Request = record {
|
||||||
|
header: TDS;
|
||||||
|
data: case(header.command) of {
|
||||||
|
REMOTE_PROCEDURE_CALL -> remoteProcedureCall : TDS_RPC;
|
||||||
|
SQL_BATCH -> sqlBatch : TDS_SQL_BATCH;
|
||||||
|
default -> unknown : bytestring &restofdata;
|
||||||
|
};
|
||||||
|
} &byteorder=bigendian;
|
||||||
|
|
||||||
|
# switch for the response portion
|
||||||
|
type TDS_Response = record {
|
||||||
|
header: TDS;
|
||||||
|
data: case(header.command) of {
|
||||||
|
RESPONSE -> response : TDS_RESPONSE;
|
||||||
|
##! SQL_BATCH -> sqlBatch : TDS_SQL_BATCH;
|
||||||
|
default -> unknown : bytestring &restofdata;
|
||||||
|
};
|
||||||
|
} &byteorder=bigendian;
|
||||||
|
|
||||||
|
type TDS = record {
|
||||||
|
command : uint8;
|
||||||
|
status : uint8;
|
||||||
|
len : uint16;
|
||||||
|
channel : uint16;
|
||||||
|
packet_number : uint8;
|
||||||
|
window : uint8;
|
||||||
|
} &byteorder=bigendian;
|
||||||
|
|
||||||
|
type TDS_RPC = record {
|
||||||
|
stream_header : Stream_Header;
|
||||||
|
name_len : uint16 &byteorder=littleendian;
|
||||||
|
procedure_name : bytestring &length=name_len*2;
|
||||||
|
option_flags : uint16 &byteorder=littleendian;
|
||||||
|
parameters : bytestring &restofdata;
|
||||||
|
} &byteorder=bigendian;
|
||||||
|
|
||||||
|
type TDS_SQL_BATCH = record {
|
||||||
|
stream_header : Stream_Header;
|
||||||
|
query : bytestring &restofdata;
|
||||||
|
} &byteorder=bigendian;
|
||||||
|
|
||||||
|
type Stream_Header = record {
|
||||||
|
total_len : uint32;
|
||||||
|
header_len : uint32;
|
||||||
|
header_type : uint16;
|
||||||
|
descriptor : uint64;
|
||||||
|
request_count : uint32;
|
||||||
|
} &byteorder=littleendian;
|
||||||
|
|
||||||
|
type TDS_RESPONSE = record {
|
||||||
|
tokens : bytestring &restofdata;
|
||||||
|
} &byteorder=bigendian;
|
||||||
14
src/tds.pac
Normal file
14
src/tds.pac
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
%include zeek/binpac.pac
|
||||||
|
%include zeek/zeek.pac
|
||||||
|
|
||||||
|
%extern{
|
||||||
|
#include "events.bif.h"
|
||||||
|
%}
|
||||||
|
|
||||||
|
analyzer TDS withcontext {
|
||||||
|
connection: TDS_Conn;
|
||||||
|
flow: TDS_Flow;
|
||||||
|
};
|
||||||
|
|
||||||
|
%include tds-protocol.pac
|
||||||
|
%include tds-analyzer.pac
|
||||||
Loading…
x
Reference in New Issue
Block a user