Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed the measurement "sample" plugin.

Browse source
This commit is contained in:
Seth Hall 2013-04-02 00:19:06 -04:00
parent f1d165956a
commit 0e3c84e863
4 changed files with 46 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

46
scripts/base/frameworks/measurement/plugins/sample.bro
View file

@ -1,3 +1,4 @@
@load base/frameworks/measurement
@load base/utils/queue @load base/utils/queue
module Measurement; module Measurement;
@ -10,40 +11,41 @@ export {
}; };
redef record ResultVal += { redef record ResultVal += {
## A sample of something being measured. This is helpful in # This is the queue where samples
## some cases for collecting information to do further detection # are maintained. Use the :bro:see:`Measurement::get_samples`
## or better logging for forensic purposes. ## function to get a vector of the samples.
samples: vector of Measurement::DataPoint &optional; samples: Queue::Queue &optional;
}; };
## Get a vector of sample DataPoint values from a ResultVal.
global get_samples: function(rv: ResultVal): vector of DataPoint;
} }
redef record ResultVal += { function get_samples(rv: ResultVal): vector of DataPoint
# Internal use only. This is the queue where samples {
# are maintained since the queue is self managing for local s: vector of DataPoint = vector();
# the number of samples requested. if ( rv?$samples )
sample_queue: Queue::Queue &optional; Queue::get_vector(rv$samples, s);
}; return s;
}
hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal) hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal)
{ {
if ( r$samples > 0 ) if ( r$samples > 0 )
{ {
if ( ! rv?$sample_queue )
rv$sample_queue = Queue::init([$max_len=r$samples]);
if ( ! rv?$samples ) if ( ! rv?$samples )
rv$samples = vector(); rv$samples = Queue::init([$max_len=r$samples]);
Queue::put(rv$sample_queue, data); Queue::put(rv$samples, data);
Queue::get_vector(rv$sample_queue, rv$samples);
} }
} }
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{ {
# Merge $sample_queue # Merge $samples
if ( rv1?$sample_queue && rv2?$sample_queue ) if ( rv1?$samples && rv2?$samples )
result$sample_queue = Queue::merge(rv1$sample_queue, rv2$sample_queue); result$samples = Queue::merge(rv1$samples, rv2$samples);
else if ( rv1?$sample_queue ) else if ( rv1?$samples )
result$sample_queue = rv1$sample_queue; result$samples = rv1$samples;
else if ( rv2?$sample_queue ) else if ( rv2?$samples )
result$sample_queue = rv2$sample_queue; result$samples = rv2$samples;
} }

4
scripts/policy/protocols/http/detect-sqli.bro
View file

@ -76,7 +76,7 @@ event bro_init() &priority=3
local r = result["http.sqli.attacker"]; local r = result["http.sqli.attacker"];
NOTICE([$note=SQL_Injection_Attacker, NOTICE([$note=SQL_Injection_Attacker,
$msg="An SQL injection attacker was discovered!", $msg="An SQL injection attacker was discovered!",
$email_body_sections=vector(format_sqli_samples(r$samples)), $email_body_sections=vector(format_sqli_samples(Measurement::get_samples(r))),
$src=key$host, $src=key$host,
$identifier=cat(key$host)]); $identifier=cat(key$host)]);
}]); }]);
@ -94,7 +94,7 @@ event bro_init() &priority=3
local r = result["http.sqli.victim"]; local r = result["http.sqli.victim"];
NOTICE([$note=SQL_Injection_Victim, NOTICE([$note=SQL_Injection_Victim,
$msg="An SQL injection victim was discovered!", $msg="An SQL injection victim was discovered!",
$email_body_sections=vector(format_sqli_samples(r$samples)), $email_body_sections=vector(format_sqli_samples(Measurement::get_samples(r))),
$src=key$host, $src=key$host,
$identifier=cat(key$host)]); $identifier=cat(key$host)]);
}]); }]);

10
testing/btest/Baseline/scripts.base.utils.queue/output
View file

@ -1,9 +1,7 @@
This is a get_cnt_vector test: 3 This is a get_vector test: 3
This is a get_cnt_vector test: 4 This is a get_vector test: 4
This is a get_str_vector test: 3 Testing get: 3
This is a get_str_vector test: 4 Length after get: 1
Testing pop: 3
Length after pop: 1
Size of q2: 4 Size of q2: 4
String queue value: test 1 String queue value: test 1
String queue value: test 2 String queue value: test 2

34
testing/btest/scripts/base/utils/queue.test
View file

@ -7,29 +7,27 @@
event bro_init() event bro_init()
{ {
local q = Queue::init([$max_len=2]); local q = Queue::init([$max_len=2]);
Queue::push(q, 1); Queue::put(q, 1);
Queue::push(q, 2); Queue::put(q, 2);
Queue::push(q, 3); Queue::put(q, 3);
Queue::push(q, 4); Queue::put(q, 4);
local test1 = Queue::get_cnt_vector(q); local test1: vector of count = vector();
Queue::get_vector(q, test1);
for ( i in test1 ) for ( i in test1 )
print fmt("This is a get_cnt_vector test: %d", test1[i]); print fmt("This is a get_vector test: %d", test1[i]);
local test2 = Queue::get_str_vector(q); local test_val = Queue::get(q);
for ( i in test2 ) print fmt("Testing get: %s", test_val);
print fmt("This is a get_str_vector test: %s", test2[i]); print fmt("Length after get: %d", Queue::len(q));
local test_val = Queue::pop(q);
print fmt("Testing pop: %s", test_val);
print fmt("Length after pop: %d", Queue::len(q));
local q2 = Queue::init([]); local q2 = Queue::init([]);
Queue::push(q2, "test 1"); Queue::put(q2, "test 1");
Queue::push(q2, "test 2"); Queue::put(q2, "test 2");
Queue::push(q2, "test 2"); Queue::put(q2, "test 2");
Queue::push(q2, "test 1"); Queue::put(q2, "test 1");
print fmt("Size of q2: %d", Queue::len(q2)); print fmt("Size of q2: %d", Queue::len(q2));
local test3: vector of string = Queue::get_str_vector(q2); local test3: vector of string = vector();
Queue::get_vector(q2, test3);
for ( i in test3 ) for ( i in test3 )
print fmt("String queue value: %s", test3[i]); print fmt("String queue value: %s", test3[i]);
} }