LLMNR Network Service Reporter

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364699);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_name(english:"LLMNR Network Service Reporter");
  script_set_attribute(attribute:"synopsis", value:
"Reports LLMNR network service settings as internal host tags.");
  script_set_attribute(attribute:"description", value:
"This plugin aggregates LLMNR network service settings collected by individual detection plugins and reports the result
as a structured internal host tag. The structured data object is reported even when only a subset of the source
plugins ran.");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_type", value:"summary");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_attribute(attribute:"always_run", value:TRUE);
  script_end_attributes();

  script_category(ACT_END);
  script_family(english:"General");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_require_keys("trigger/llmnr_network_service_reporter");

  exit(0);
}

include('debug.inc');
include('structured_data_network_services.inc');

# the KB key 'trigger/llmnr_network_service_reporter' is used within script_require_keys to manage when this plugin runs.
# listing the other KB keys produced by the source plugins in script_require_ports won't work reliably in all cases,
# as the value of 0 is handled the same as not present.

var remote_llmnr_enabled = get_kb_item('plugins/53513/llmnr_enabled');
var win_reg_llmnr_enabled = get_kb_item('plugins/160301/llmnr_enabled');

if (remote_llmnr_enabled == 1 || win_reg_llmnr_enabled == 1)
{
  structured_data_network_services.set('state', 'enabled');
  # RFC 4795 defines a hardcoded port for LLMNR
  structured_data_network_services.set('listening_port', 5355);
}
else if ((!empty_or_null(remote_llmnr_enabled) && remote_llmnr_enabled == 0) || 
         (!empty_or_null(win_reg_llmnr_enabled) && win_reg_llmnr_enabled == 0))
{
  structured_data_network_services.set('state', 'disabled');
}
else
{
  # this should never happen, unless one of the source plugins gets incorrectly modified in future and starts reporting incorrect data
  structured_data_network_services.set('state', 'unknown');
}

structured_data_network_services.set('application_protocol', 'llmnr');
structured_data_network_services.report_internal();

# for testing purposes only - start
var FLATLINE_TEST = !isnull(get_kb_item("flatline/TEST"));
if (FLATLINE_TEST)
{
  dbg::enable();
  dbg::set_log_level(1);

  var sd_data = structured_data_network_services.data;
  var output = strcat(
    'application_protocol: ', string(sd_data["application_protocol"]), '\n',
    'state: ', string(sd_data["state"]), '\n',
    'listening_port: ', string(sd_data["listening_port"]), '\n'
  );

  dbg::detailed_log(lvl:1, src:SCRIPT_NAME, msg:output);
}
# for testing purposes only - end

exit(0, "This plugin does not produce output.");