Skip to content

Commit abcff5b

Browse files
pmphrypmphry
authored
Merge pull request #2 from DynamiteAI/bug/field-exist-checks
Bug/field exist checks
2 parents 08a7415 + 2c3b38a commit abcff5b

26 files changed

Lines changed: 270 additions & 134 deletions

‎scripts/Corelight/CommunityID/__load__.zeek‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
@ifdef (CommunityID::hash_conn)
22
@load ./connection
33
@load ./dce_rpc
4-
#@load ./dhcp
54
@load ./dnp3
65
@load ./dns
76
@load ./ftp
@@ -23,5 +22,4 @@
2322
@load ./ssh
2423
@load ./ssl
2524
@load ./syslog
26-
@load ./tunnel
2725
@endif

‎scripts/Corelight/CommunityID/dce_rpc.zeek‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,20 @@ export {
77

88
event dce_rpc_request(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count)
99
{
10-
if ( ! c$dce_rpc?$community_id && c?$community_id )
11-
c$dce_rpc$community_id = c$community_id;
10+
if ( c?$dce_rpc )
11+
{
12+
if ( ! c$dce_rpc?$community_id && c?$community_id )
13+
c$dce_rpc$community_id = c$community_id;
14+
}
1215
}
1316

1417
event dce_rpc_response(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count)
1518
{
16-
if ( ! c$dce_rpc?$community_id && c?$community_id )
17-
c$dce_rpc$community_id = c$community_id;
19+
if ( c?$dce_rpc )
20+
{
21+
if ( ! c$dce_rpc?$community_id && c?$community_id )
22+
c$dce_rpc$community_id = c$community_id;
23+
}
1824
}
1925

2026
@endif

‎scripts/Corelight/CommunityID/dhcp.zeek‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎scripts/Corelight/CommunityID/dnp3.zeek‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,20 @@ export {
88

99
event dnp3_application_request_header(c: connection, is_orig: bool, application: count, fc: count)
1010
{
11-
if ( ! c$dnp3?$community_id && c?$community_id )
12-
c$dnp3$community_id = c$community_id;
11+
if ( c?$dnp3 )
12+
{
13+
if ( ! c$dnp3?$community_id && c?$community_id )
14+
c$dnp3$community_id = c$community_id;
15+
}
1316
}
1417

1518
event dnp3_application_response_header(c: connection, is_orig: bool, application: count, fc: count, iin: count)
1619
{
17-
if ( ! c$dnp3?$community_id && c?$community_id )
18-
c$dnp3$community_id = c$community_id;
20+
if ( c?$dnp3 )
21+
{
22+
if ( ! c$dnp3?$community_id && c?$community_id )
23+
c$dnp3$community_id = c$community_id;
24+
}
1925
}
2026

2127
@endif

‎scripts/Corelight/CommunityID/dns.zeek‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,20 @@ export {
99

1010
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) &priority=-5
1111
{
12-
# new_connection is not being triggered for UDP, so we need another plan
13-
if (! c$dns?$community_id && c?$community_id)
14-
c$dns$community_id = c$community_id;
12+
if ( c?$dns )
13+
{
14+
if (! c$dns?$community_id && c?$community_id)
15+
c$dns$community_id = c$community_id;
16+
}
1517
}
1618

1719
event dns_end(c: connection, msg: dns_msg)
1820
{
19-
if (! c$dns?$community_id && c?$community_id)
20-
c$dns$community_id = c$community_id;
21+
if ( c?$dns )
22+
{
23+
if (! c$dns?$community_id && c?$community_id)
24+
c$dns$community_id = c$community_id;
25+
}
2126
}
2227

2328
@endif

‎scripts/Corelight/CommunityID/ftp.zeek‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,20 @@ export {
88

99
event ftp_request(c: connection, command: string, arg: string)
1010
{
11-
if ( ! c$ftp?$community_id && c?$community_id )
12-
c$ftp$community_id = c$community_id;
11+
if ( c?$ftp )
12+
{
13+
if ( ! c$ftp?$community_id && c?$community_id )
14+
c$ftp$community_id = c$community_id;
15+
}
1316
}
1417

1518
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool)
1619
{
17-
if ( ! c$ftp?$community_id && c?$community_id )
18-
c$ftp$community_id = c$community_id;
20+
if ( c?$ftp )
21+
{
22+
if ( ! c$ftp?$community_id && c?$community_id )
23+
c$ftp$community_id = c$community_id;
24+
}
1925
}
2026

2127
@endif

‎scripts/Corelight/CommunityID/http.zeek‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,20 @@ export {
99

1010
event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string)
1111
{
12-
if (! c$http?$community_id && c?$community_id)
13-
c$http$community_id = c$community_id;
12+
if ( c?$http )
13+
{
14+
if (! c$http?$community_id && c?$community_id)
15+
c$http$community_id = c$community_id;
16+
}
1417
}
1518

1619
event http_reply(c: connection, version: string, code: count, reason: string)
1720
{
18-
if (! c$http?$community_id && c?$community_id)
19-
c$http$community_id = c$community_id;
21+
if ( c?$http )
22+
{
23+
if (! c$http?$community_id && c?$community_id)
24+
c$http$community_id = c$community_id;
25+
}
2026
}
2127

2228
@endif

‎scripts/Corelight/CommunityID/irc.zeek‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,20 @@ export {
77
}
88
event irc_request(c: connection, is_orig: bool, prefix: string, command: string, arguments: string)
99
{
10-
if ( ! c$irc?$community_id && c?$community_id )
11-
c$irc$community_id = c$community_id;
10+
if ( c?$dns )
11+
{
12+
if ( ! c$irc?$community_id && c?$community_id )
13+
c$irc$community_id = c$community_id;
14+
}
1215
}
1316

1417
event irc_reply(c: connection, is_orig: bool, prefix: string, code: count, params: string)
1518
{
16-
if ( ! c$irc?$community_id && c?$community_id )
17-
c$irc$community_id = c$community_id;
19+
if ( c?$dns )
20+
{
21+
if ( ! c$irc?$community_id && c?$community_id )
22+
c$irc$community_id = c$community_id;
23+
}
1824
}
1925

2026
@endif

‎scripts/Corelight/CommunityID/krb.zeek‎

Lines changed: 30 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,38 +8,56 @@ export {
88

99
event krb_ap_request(c: connection, ticket: KRB::Ticket, opts: KRB::AP_Options)
1010
{
11-
if ( ! c$krb?$community_id && c?$community_id )
12-
c$krb$community_id = c$community_id;
11+
if ( c?$krb )
12+
{
13+
if ( ! c$krb?$community_id && c?$community_id )
14+
c$krb$community_id = c$community_id;
15+
}
1316
}
1417

1518
event krb_ap_response(c: connection)
1619
{
17-
if ( ! c$krb?$community_id && c?$community_id )
18-
c$krb$community_id = c$community_id;
20+
if ( c?$krb )
21+
{
22+
if ( ! c$krb?$community_id && c?$community_id )
23+
c$krb$community_id = c$community_id;
24+
}
1925
}
2026

2127
event krb_as_request(c: connection, msg: KRB::KDC_Request)
2228
{
23-
if ( ! c$krb?$community_id && c?$community_id )
24-
c$krb$community_id = c$community_id;
29+
if ( c?$krb )
30+
{
31+
if ( ! c$krb?$community_id && c?$community_id )
32+
c$krb$community_id = c$community_id;
33+
}
2534
}
2635

2736
event krb_as_response(c: connection, msg: KRB::KDC_Response)
2837
{
29-
if ( ! c$krb?$community_id && c?$community_id )
30-
c$krb$community_id = c$community_id;
38+
if ( c?$krb )
39+
{
40+
if ( ! c$krb?$community_id && c?$community_id )
41+
c$krb$community_id = c$community_id;
42+
}
3143
}
3244

3345
event krb_tgs_request(c: connection, msg: KRB::KDC_Request)
3446
{
35-
if ( ! c$krb?$community_id && c?$community_id )
36-
c$krb$community_id = c$community_id;
47+
if ( c?$krb )
48+
{
49+
if ( ! c$krb?$community_id && c?$community_id )
50+
c$krb$community_id = c$community_id;
51+
}
3752
}
3853

3954
event krb_tgs_response(c: connection, msg: KRB::KDC_Response)
4055
{
41-
if ( ! c$krb?$community_id && c?$community_id )
42-
c$krb$community_id = c$community_id;
56+
if ( c?$krb )
57+
{
58+
if ( ! c$krb?$community_id && c?$community_id )
59+
c$krb$community_id = c$community_id;
60+
}
4361
}
4462

4563
@endif

‎scripts/Corelight/CommunityID/modbus.zeek‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@ export {
77

88
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool)
99
{
10-
if ( ! c$modbus?$community_id && c?$community_id )
11-
c$modbus$community_id = c$community_id;
10+
if ( c?$modbus )
11+
{
12+
if ( ! c$modbus?$community_id && c?$community_id )
13+
c$modbus$community_id = c$community_id;
14+
}
1215
}
1316
@endif

0 commit comments

Comments
 (0)