Repository: cowrie/cowrie

Issue:
Support to log direct-tcpip to database backends
Currently connection attempts are only logged in logfiles and not to database backends.
This would be a nice feature :)
Support to log direct-tcpip to database backends
Currently connection attempts are only logged in logfiles and not to database backends.
This would be a nice feature :)


Discussion:

Resolving patch:
diff --git a/src/cowrie/output/mongodb.py b/src/cowrie/output/mongodb.py
--- a/src/cowrie/output/mongodb.py
+++ b/src/cowrie/output/mongodb.py
@@ -47,6 +47,8 @@ def start(self):
             self.col_ttylog = self.mongo_db['ttylog']
             self.col_keyfingerprints = self.mongo_db['keyfingerprints']
             self.col_event = self.mongo_db['event']
+            self.col_ipforwards = self.mongo_db['ipforwards']
+            self.col_ipforwardsdata = self.mongo_db['ipforwardsdata']
         except Exception as e:
             log.msg('output_mongodb: Error: %s' % str(e))
 
@@ -121,6 +123,12 @@ def write(self, entry):
         elif eventid == 'cowrie.client.fingerprint':
             self.insert_one(self.col_keyfingerprints, entry)
 
+        elif eventid == 'cowrie.direct-tcpip.request':
+            self.insert_one(self.col_ipforwards, entry)
+
+        elif eventid == 'cowrie.direct-tcpip.data':
+            self.insert_one(self.col_ipforwardsdata, entry)
+
         # Catch any other event types
         else:
             self.insert_one(self.col_event, entry)
diff --git a/src/cowrie/output/mysql.py b/src/cowrie/output/mysql.py
--- a/src/cowrie/output/mysql.py
+++ b/src/cowrie/output/mysql.py
@@ -204,3 +204,15 @@ def write(self, entry):
                 'INSERT INTO `keyfingerprints` (`session`, `username`, `fingerprint`) '
                 'VALUES (%s, %s, %s)',
                 (entry["session"], entry["username"], entry["fingerprint"]))
+
+        elif entry["eventid"] == 'cowrie.direct-tcpip.request':
+            self.simpleQuery(
+                'INSERT INTO `ipforwards` (`session`, `timestamp`, `dst_ip`, `dst_port`) '
+                'VALUES (%s, FROM_UNIXTIME(%s), %s, %s)',
+                (entry["session"], entry["time"], entry["dst_ip"], entry["dst_port"]))
+
+        elif entry["eventid"] == 'cowrie.direct-tcpip.data':
+            self.simpleQuery(
+                'INSERT INTO `ipforwardsdata` (`session`, `timestamp`, `dst_ip`, `dst_port`, `data`) '
+                'VALUES (%s, FROM_UNIXTIME(%s), %s, %s, %s)',
+                (entry["session"], entry["time"], entry["dst_ip"], entry["dst_port"], entry["data"]))
diff --git a/src/cowrie/output/sqlite.py b/src/cowrie/output/sqlite.py
--- a/src/cowrie/output/sqlite.py
+++ b/src/cowrie/output/sqlite.py
@@ -176,3 +176,15 @@ def write(self, entry):
                 'INSERT INTO `keyfingerprints` (`session`, `username`, `fingerprint`) '
                 'VALUES (?, ?, ?)',
                 (entry["session"], entry["username"], entry["fingerprint"]))
+
+        elif entry["eventid"] == 'cowrie.direct-tcpip.request':
+            self.simpleQuery(
+                'INSERT INTO `ipforwards` (`session`, `timestamp`, `dst_ip`, `dst_port`) '
+                'VALUES (?, ?, ?, ?)',
+                (entry["session"], entry["timestamp"], entry["dst_ip"], entry["dst_port"]))
+
+        elif entry["eventid"] == 'cowrie.direct-tcpip.data':
+            self.simpleQuery(
+                'INSERT INTO `ipforwardsdata` (`session`, `timestamp`, `dst_ip`, `dst_port`, `data`) '
+                'VALUES (?, ?, ?, ?, ?)',
+                (entry["session"], entry["timestamp"], entry["dst_ip"], entry["dst_port"], entry["data"]))


Test patch: