forked from sethhall/bro-scripts
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add a script that adds the hostnames to conn objects and creates a conn_hostnames log. Should possible be two scripts :)
- Loading branch information
1 parent
fa7804f
commit 3329068
Showing
1 changed file
with
42 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,42 @@ | ||
@load base/protocols/conn | ||
@load base/protocols/http | ||
@load base/protocols/ssl | ||
@load base/utils/site | ||
|
||
module Conn; | ||
|
||
event connection_established(c: connection) | ||
{ | ||
Conn::set_conn(c, F); | ||
} | ||
|
||
redef record Conn::Info += { | ||
resp_hostname: string &optional &log; | ||
}; | ||
|
||
event http_header (c: connection, is_orig: bool, name: string, value: string) | ||
{ | ||
if(name == "HOST") { | ||
c$conn$resp_hostname = value; | ||
print "set hostname", value; | ||
flush_all(); | ||
} | ||
} | ||
|
||
event ssl_established(c: connection) | ||
{ | ||
if(c?$ssl && c$ssl?$server_name) { | ||
c$conn$resp_hostname = c$ssl$server_name; | ||
print "set hostname", c$ssl$server_name; | ||
flush_all(); | ||
} | ||
} | ||
|
||
event bro_init() | ||
{ | ||
Log::add_filter(Conn::LOG, [$name = "conn-hostnames", | ||
$path = "conn_hostnames", | ||
$pred(rec: Conn::Info) = { | ||
return (rec?$resp_hostname); | ||
}]); | ||
} |