From 0e3c84e863b285e45e11c937f7b77ace76373c96 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Tue, 2 Apr 2013 00:19:06 -0400 Subject: [PATCH] Fixed the measurement "sample" plugin. --- .../frameworks/measurement/plugins/sample.bro | 46 ++++++++++--------- scripts/policy/protocols/http/detect-sqli.bro | 4 +- .../Baseline/scripts.base.utils.queue/output | 10 ++-- testing/btest/scripts/base/utils/queue.test | 34 +++++++------- 4 files changed, 46 insertions(+), 48 deletions(-) diff --git a/scripts/base/frameworks/measurement/plugins/sample.bro b/scripts/base/frameworks/measurement/plugins/sample.bro index 018b7c9652..399f572490 100644 --- a/scripts/base/frameworks/measurement/plugins/sample.bro +++ b/scripts/base/frameworks/measurement/plugins/sample.bro @@ -1,3 +1,4 @@ +@load base/frameworks/measurement @load base/utils/queue module Measurement; @@ -10,40 +11,41 @@ export { }; redef record ResultVal += { - ## A sample of something being measured. This is helpful in - ## some cases for collecting information to do further detection - ## or better logging for forensic purposes. - samples: vector of Measurement::DataPoint &optional; + # This is the queue where samples + # are maintained. Use the :bro:see:`Measurement::get_samples` + ## function to get a vector of the samples. + samples: Queue::Queue &optional; }; + + ## Get a vector of sample DataPoint values from a ResultVal. + global get_samples: function(rv: ResultVal): vector of DataPoint; } -redef record ResultVal += { - # Internal use only. This is the queue where samples - # are maintained since the queue is self managing for - # the number of samples requested. - sample_queue: Queue::Queue &optional; -}; +function get_samples(rv: ResultVal): vector of DataPoint + { + local s: vector of DataPoint = vector(); + if ( rv?$samples ) + Queue::get_vector(rv$samples, s); + return s; + } hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal) { if ( r$samples > 0 ) { - if ( ! rv?$sample_queue ) - rv$sample_queue = Queue::init([$max_len=r$samples]); if ( ! rv?$samples ) - rv$samples = vector(); - Queue::put(rv$sample_queue, data); - Queue::get_vector(rv$sample_queue, rv$samples); + rv$samples = Queue::init([$max_len=r$samples]); + Queue::put(rv$samples, data); } } hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) { - # Merge $sample_queue - if ( rv1?$sample_queue && rv2?$sample_queue ) - result$sample_queue = Queue::merge(rv1$sample_queue, rv2$sample_queue); - else if ( rv1?$sample_queue ) - result$sample_queue = rv1$sample_queue; - else if ( rv2?$sample_queue ) - result$sample_queue = rv2$sample_queue; + # Merge $samples + if ( rv1?$samples && rv2?$samples ) + result$samples = Queue::merge(rv1$samples, rv2$samples); + else if ( rv1?$samples ) + result$samples = rv1$samples; + else if ( rv2?$samples ) + result$samples = rv2$samples; } \ No newline at end of file diff --git a/scripts/policy/protocols/http/detect-sqli.bro b/scripts/policy/protocols/http/detect-sqli.bro index bb47ec2f47..f5e15c5505 100644 --- a/scripts/policy/protocols/http/detect-sqli.bro +++ b/scripts/policy/protocols/http/detect-sqli.bro @@ -76,7 +76,7 @@ event bro_init() &priority=3 local r = result["http.sqli.attacker"]; NOTICE([$note=SQL_Injection_Attacker, $msg="An SQL injection attacker was discovered!", - $email_body_sections=vector(format_sqli_samples(r$samples)), + $email_body_sections=vector(format_sqli_samples(Measurement::get_samples(r))), $src=key$host, $identifier=cat(key$host)]); }]); @@ -94,7 +94,7 @@ event bro_init() &priority=3 local r = result["http.sqli.victim"]; NOTICE([$note=SQL_Injection_Victim, $msg="An SQL injection victim was discovered!", - $email_body_sections=vector(format_sqli_samples(r$samples)), + $email_body_sections=vector(format_sqli_samples(Measurement::get_samples(r))), $src=key$host, $identifier=cat(key$host)]); }]); diff --git a/testing/btest/Baseline/scripts.base.utils.queue/output b/testing/btest/Baseline/scripts.base.utils.queue/output index b878006310..e54dd89f7a 100644 --- a/testing/btest/Baseline/scripts.base.utils.queue/output +++ b/testing/btest/Baseline/scripts.base.utils.queue/output @@ -1,9 +1,7 @@ -This is a get_cnt_vector test: 3 -This is a get_cnt_vector test: 4 -This is a get_str_vector test: 3 -This is a get_str_vector test: 4 -Testing pop: 3 -Length after pop: 1 +This is a get_vector test: 3 +This is a get_vector test: 4 +Testing get: 3 +Length after get: 1 Size of q2: 4 String queue value: test 1 String queue value: test 2 diff --git a/testing/btest/scripts/base/utils/queue.test b/testing/btest/scripts/base/utils/queue.test index 50f541a25f..344ea73f45 100644 --- a/testing/btest/scripts/base/utils/queue.test +++ b/testing/btest/scripts/base/utils/queue.test @@ -7,29 +7,27 @@ event bro_init() { local q = Queue::init([$max_len=2]); - Queue::push(q, 1); - Queue::push(q, 2); - Queue::push(q, 3); - Queue::push(q, 4); - local test1 = Queue::get_cnt_vector(q); + Queue::put(q, 1); + Queue::put(q, 2); + Queue::put(q, 3); + Queue::put(q, 4); + local test1: vector of count = vector(); + Queue::get_vector(q, test1); for ( i in test1 ) - print fmt("This is a get_cnt_vector test: %d", test1[i]); + print fmt("This is a get_vector test: %d", test1[i]); - local test2 = Queue::get_str_vector(q); - for ( i in test2 ) - print fmt("This is a get_str_vector test: %s", test2[i]); - - local test_val = Queue::pop(q); - print fmt("Testing pop: %s", test_val); - print fmt("Length after pop: %d", Queue::len(q)); + local test_val = Queue::get(q); + print fmt("Testing get: %s", test_val); + print fmt("Length after get: %d", Queue::len(q)); local q2 = Queue::init([]); - Queue::push(q2, "test 1"); - Queue::push(q2, "test 2"); - Queue::push(q2, "test 2"); - Queue::push(q2, "test 1"); + Queue::put(q2, "test 1"); + Queue::put(q2, "test 2"); + Queue::put(q2, "test 2"); + Queue::put(q2, "test 1"); print fmt("Size of q2: %d", Queue::len(q2)); - local test3: vector of string = Queue::get_str_vector(q2); + local test3: vector of string = vector(); + Queue::get_vector(q2, test3); for ( i in test3 ) print fmt("String queue value: %s", test3[i]); } \ No newline at end of file