feat: add source ip and source port (#126)

add source ip and source port
This commit is contained in:
Mario Candela
2024-08-30 08:28:56 +02:00
committed by GitHub
parent fa472effb9
commit 0b5486964b
4 changed files with 22 additions and 1 deletions

View File

@ -6,6 +6,7 @@ import (
"github.com/mariocandela/beelzebub/v3/plugins" "github.com/mariocandela/beelzebub/v3/plugins"
"github.com/mariocandela/beelzebub/v3/tracer" "github.com/mariocandela/beelzebub/v3/tracer"
"io" "io"
"net"
"net/http" "net/http"
"regexp" "regexp"
"strings" "strings"
@ -91,6 +92,8 @@ func traceRequest(request *http.Request, tr tracer.Tracer, HoneypotDescription s
if err == nil { if err == nil {
body = string(bodyBytes) body = string(bodyBytes)
} }
host, port, _ := net.SplitHostPort(request.RemoteAddr)
tr.TraceEvent(tracer.Event{ tr.TraceEvent(tracer.Event{
Msg: "HTTP New request", Msg: "HTTP New request",
RequestURI: request.RequestURI, RequestURI: request.RequestURI,
@ -103,6 +106,8 @@ func traceRequest(request *http.Request, tr tracer.Tracer, HoneypotDescription s
Headers: mapHeaderToString(request.Header), Headers: mapHeaderToString(request.Header),
Status: tracer.Stateless.String(), Status: tracer.Stateless.String(),
RemoteAddr: request.RemoteAddr, RemoteAddr: request.RemoteAddr,
SourceIp: host,
SourcePort: port,
ID: uuid.New().String(), ID: uuid.New().String(),
Description: HoneypotDescription, Description: HoneypotDescription,
}) })

View File

@ -5,8 +5,8 @@ import (
"github.com/mariocandela/beelzebub/v3/parser" "github.com/mariocandela/beelzebub/v3/parser"
"github.com/mariocandela/beelzebub/v3/plugins" "github.com/mariocandela/beelzebub/v3/plugins"
"github.com/mariocandela/beelzebub/v3/tracer" "github.com/mariocandela/beelzebub/v3/tracer"
"net"
"regexp" "regexp"
"strings" "strings"
"time" "time"
@ -29,10 +29,14 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
Handler: func(sess ssh.Session) { Handler: func(sess ssh.Session) {
uuidSession := uuid.New() uuidSession := uuid.New()
host, port, _ := net.SplitHostPort(sess.RemoteAddr().String())
tr.TraceEvent(tracer.Event{ tr.TraceEvent(tracer.Event{
Msg: "New SSH Session", Msg: "New SSH Session",
Protocol: tracer.SSH.String(), Protocol: tracer.SSH.String(),
RemoteAddr: sess.RemoteAddr().String(), RemoteAddr: sess.RemoteAddr().String(),
SourceIp: host,
SourcePort: port,
Status: tracer.Start.String(), Status: tracer.Start.String(),
ID: uuidSession.String(), ID: uuidSession.String(),
Environ: strings.Join(sess.Environ(), ","), Environ: strings.Join(sess.Environ(), ","),
@ -95,6 +99,8 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
tr.TraceEvent(tracer.Event{ tr.TraceEvent(tracer.Event{
Msg: "New SSH Terminal Session", Msg: "New SSH Terminal Session",
RemoteAddr: sess.RemoteAddr().String(), RemoteAddr: sess.RemoteAddr().String(),
SourceIp: host,
SourcePort: port,
Status: tracer.Interaction.String(), Status: tracer.Interaction.String(),
Command: commandInput, Command: commandInput,
CommandOutput: commandOutput, CommandOutput: commandOutput,
@ -113,6 +119,8 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
}) })
}, },
PasswordHandler: func(ctx ssh.Context, password string) bool { PasswordHandler: func(ctx ssh.Context, password string) bool {
host, port, _ := net.SplitHostPort(ctx.RemoteAddr().String())
tr.TraceEvent(tracer.Event{ tr.TraceEvent(tracer.Event{
Msg: "New SSH attempt", Msg: "New SSH attempt",
Protocol: tracer.SSH.String(), Protocol: tracer.SSH.String(),
@ -121,6 +129,8 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
Password: password, Password: password,
Client: ctx.ClientVersion(), Client: ctx.ClientVersion(),
RemoteAddr: ctx.RemoteAddr().String(), RemoteAddr: ctx.RemoteAddr().String(),
SourceIp: host,
SourcePort: port,
ID: uuid.New().String(), ID: uuid.New().String(),
Description: beelzebubServiceConfiguration.Description, Description: beelzebubServiceConfiguration.Description,
}) })

View File

@ -35,12 +35,16 @@ func (tcpStrategy *TCPStrategy) Init(beelzebubServiceConfiguration parser.Beelze
command = string(buffer[:n]) command = string(buffer[:n])
} }
host, port, _ := net.SplitHostPort(conn.RemoteAddr().String())
tr.TraceEvent(tracer.Event{ tr.TraceEvent(tracer.Event{
Msg: "New TCP attempt", Msg: "New TCP attempt",
Protocol: tracer.TCP.String(), Protocol: tracer.TCP.String(),
Command: command, Command: command,
Status: tracer.Stateless.String(), Status: tracer.Stateless.String(),
RemoteAddr: conn.RemoteAddr().String(), RemoteAddr: conn.RemoteAddr().String(),
SourceIp: host,
SourcePort: port,
ID: uuid.New().String(), ID: uuid.New().String(),
Description: beelzebubServiceConfiguration.Description, Description: beelzebubServiceConfiguration.Description,
}) })

View File

@ -34,6 +34,8 @@ type Event struct {
HTTPMethod string HTTPMethod string
RequestURI string RequestURI string
Description string Description string
SourceIp string
SourcePort string
} }
type ( type (