Skip to content

Commit

Permalink
connection hostnames logging
Browse files Browse the repository at this point in the history
add a script that adds the hostnames to conn objects and creates a
conn_hostnames log.  Should possible be two scripts :)
  • Loading branch information
JustinAzoff committed Dec 12, 2012
1 parent fa7804f commit 3329068
Showing 1 changed file with 42 additions and 0 deletions.
42 changes: 42 additions & 0 deletions conn-hostnames.bro
@@ -0,0 +1,42 @@
@load base/protocols/conn
@load base/protocols/http
@load base/protocols/ssl
@load base/utils/site

module Conn;

event connection_established(c: connection)
{
Conn::set_conn(c, F);
}

redef record Conn::Info += {
resp_hostname: string &optional &log;
};

event http_header (c: connection, is_orig: bool, name: string, value: string)
{
if(name == "HOST") {
c$conn$resp_hostname = value;
print "set hostname", value;
flush_all();
}
}

event ssl_established(c: connection)
{
if(c?$ssl && c$ssl?$server_name) {
c$conn$resp_hostname = c$ssl$server_name;
print "set hostname", c$ssl$server_name;
flush_all();
}
}

event bro_init()
{
Log::add_filter(Conn::LOG, [$name = "conn-hostnames",
$path = "conn_hostnames",
$pred(rec: Conn::Info) = {
return (rec?$resp_hostname);
}]);
}

0 comments on commit 3329068

Please sign in to comment.