# $Id: ident.bro,v 1.17 2003/08/31 00:40:21 vern Exp $

@load alert
@load active
@load hot-ids

redef enum Alert += {
	IdentSensitiveID,	# sensitive username in Ident lookup
};

redef capture_filters += { ["ident"] = "tcp port 113" };

global hot_ident_ids = { always_hot_ids, } &redef;
global hot_ident_exceptions = { "uucp", "nuucp", "daemon", } &redef;

global pending_ident_requests: set[addr, port, addr, port, port, port];

event ident_request(c: connection, lport: port, rport: port)
	{
	local id = c$id;
	add pending_ident_requests[id$orig_h, id$orig_p, id$resp_h, id$resp_p, lport, rport];
	}

function add_ident_tag(c: connection, lport: port, rport: port, tag: string)
: connection
	{
	local id = c$id;
	if ( [id$orig_h, id$orig_p, id$resp_h, id$resp_p, lport, rport] in
	     pending_ident_requests )
		delete pending_ident_requests[id$orig_h, id$orig_p, id$resp_h, id$resp_p, lport, rport];
	else
		tag = fmt("orphan-%s", tag);

	local c_orig =
		[id$resp_h, rport, id$orig_h, lport] in active_conn ?
			active_conn[id$resp_h, rport, id$orig_h, lport] : c;

	append_addl(c_orig, tag);

	return c_orig;
	}

event ident_reply(c: connection, lport: port, rport: port,
		user_id: string, system: string)
	{
	local c_orig = add_ident_tag(c, lport, rport, fmt("ident/%s", user_id));

	if ( user_id in hot_ident_ids && user_id !in hot_ident_exceptions )
		{
		++c_orig$hot;
		ALERT([$alert=IdentSensitiveID, $conn=c,
			$msg=fmt("%s hot ident: %s",
				id_string(c_orig$id), c_orig$addl)]);
		}
	}

event ident_error(c: connection, lport: port, rport: port, line: string)
	{
	add_ident_tag(c, lport, rport, fmt("iderr/%s", line));
	}
