Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Logging framework update and mass Log::ID renaming.

Browse source 
- Log path's are generated in the scripting land
  now.  The default Log stream ID to path string
  mapping works like this:
    - Notice::LOG -> "notice"
    - Notice::POLICY_LOG -> "notice_policy"
    - TestModule::LOG -> "test_module"

- Logging streams updated across all of the shipped
  scripts to be more user friendly.  Instead of
  the logging stream ID HTTP::HTTP, we now have
  HTTP::LOG, etc.

- The priorities on some bro_init handlers have
  been adjusted to make the process of applying
  filters or disabling streams easier for users.
This commit is contained in:
Seth Hall 2011-09-03 01:10:17 -04:00
parent fe53091cd1
commit 11c437faa3
77 changed files with 391 additions and 619 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/policy/integration/barnyard2/main.bro
View file

@ -7,7 +7,7 @@
module Barnyard2;
export {
redef enum Log::ID += { BARNYARD2 };
redef enum Log::ID += { LOG };
type Info: record {
ts: time &log;
@ -21,9 +21,9 @@ export {
global pid2cid: function(p: PacketID): conn_id;
}
event bro_init()
event bro_init() &priority=5
{
Log::create_stream(BARNYARD2, [$columns=Info]);
Log::create_stream(Barnyard2::LOG, [$columns=Info]);
}
@ -34,7 +34,7 @@ function pid2cid(p: PacketID): conn_id
event barnyard_alert(id: PacketID, alert: AlertData, msg: string, data: string)
{
Log::write(BARNYARD2, [$ts=network_time(), $pid=id, $alert=alert]);
Log::write(Barnyard2::LOG, [$ts=network_time(), $pid=id, $alert=alert]);
#local proto_connection_string: string;
#if ( id$src_p == 0/tcp )

6
scripts/policy/misc/loaded-scripts.bro
View file

@ -1,7 +1,7 @@
module LoadedScripts;
export {
redef enum Log::ID += { LOADED_SCRIPTS };
redef enum Log::ID += { LOG };
type Info: record {
depth: count &log;
@ -11,10 +11,10 @@ export {
event bro_init()
{
Log::create_stream(LOADED_SCRIPTS, [$columns=Info]);
Log::create_stream(LoadedScripts::LOG, [$columns=Info]);
}
event bro_script_loaded(path: string, level: count)
{
Log::write(LOADED_SCRIPTS, [$depth=level, $name=path]);
Log::write(LoadedScripts::LOG, [$depth=level, $name=path]);
}

12
scripts/policy/protocols/conn/known-hosts.bro
View file

@ -5,10 +5,10 @@
@load base/utils/directions-and-hosts
module KnownHosts;
module Known;
export {
redef enum Log::ID += { KNOWN_HOSTS };
redef enum Log::ID += { HOSTS_LOG };
type Info: record {
## The timestamp at which the host was detected.
@ -20,7 +20,7 @@ export {
## The hosts whose existence should be logged and tracked.
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
const asset_tracking = LOCAL_HOSTS &redef;
const host_tracking = LOCAL_HOSTS &redef;
## The set of all known addresses to store for preventing duplicate
## logging of addresses. It can also be used from other scripts to
@ -34,7 +34,7 @@ export {
event bro_init()
{
Log::create_stream(KNOWN_HOSTS, [$columns=Info, $ev=log_known_hosts]);
Log::create_stream(Known::HOSTS_LOG, [$columns=Info, $ev=log_known_hosts]);
}
event connection_established(c: connection) &priority=5
@ -43,10 +43,10 @@ event connection_established(c: connection) &priority=5
for ( host in set(id$orig_h, id$resp_h) )
{
if ( host !in known_hosts && addr_matches_host(host, asset_tracking) )
if ( host !in known_hosts && addr_matches_host(host, host_tracking) )
{
add known_hosts[host];
Log::write(KNOWN_HOSTS, [$ts=network_time(), $host=host]);
Log::write(Known::HOSTS_LOG, [$ts=network_time(), $host=host]);
}
}
}

14
scripts/policy/protocols/conn/known-services.bro
View file

@ -5,9 +5,9 @@
@load base/utils/directions-and-hosts
module KnownServices;
module Known;
redef enum Log::ID += { KNOWN_SERVICES };
redef enum Log::ID += { SERVICES_LOG };
export {
type Info: record {
@ -21,7 +21,7 @@ export {
};
## The hosts whose services should be tracked and logged.
const asset_tracking = LOCAL_HOSTS &redef;
const service_tracking = LOCAL_HOSTS &redef;
global known_services: set[addr, port] &create_expire=1day &synchronized;
@ -35,8 +35,8 @@ redef record connection += {
event bro_init()
{
Log::create_stream(KNOWN_SERVICES, [$columns=Info,
$ev=log_known_services]);
Log::create_stream(Known::SERVICES_LOG, [$columns=Info,
$ev=log_known_services]);
}
function known_services_done(c: connection)
@ -44,7 +44,7 @@ function known_services_done(c: connection)
local id = c$id;
if ( ! c$known_services_done &&
get_port_transport_proto(id$resp_p) == tcp &&
addr_matches_host(id$resp_h, asset_tracking) &&
addr_matches_host(id$resp_h, service_tracking) &&
[id$resp_h, id$resp_p] !in known_services &&
"ftp-data" !in c$service ) # don't include ftp data sessions
{
@ -56,7 +56,7 @@ function known_services_done(c: connection)
i$service=c$service;
add known_services[id$resp_h, id$resp_p];
Log::write(KNOWN_SERVICES, i);
Log::write(Known::SERVICES_LOG, i);
c$known_services_done = T;
}
}

18
scripts/policy/protocols/ssl/known-certs.bro
View file

@ -1,9 +1,9 @@
@load base/utils/directions-and-hosts
module KnownCerts;
module Known;
export {
redef enum Log::ID += { KNOWN_CERTS };
redef enum Log::ID += { CERTS_LOG };
type Info: record {
## The timestamp when the certificate was detected.
@ -23,7 +23,7 @@ export {
## The certificates whose existence should be logged and tracked.
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
const asset_tracking = LOCAL_HOSTS &redef;
const cert_tracking = LOCAL_HOSTS &redef;
## The set of all known certificates to store for preventing duplicate
## logging. It can also be used from other scripts to
@ -36,7 +36,7 @@ export {
event bro_init()
{
Log::create_stream(KNOWN_CERTS, [$columns=Info, $ev=log_known_certs]);
Log::create_stream(Known::CERTS_LOG, [$columns=Info, $ev=log_known_certs]);
}
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string)
@ -47,12 +47,12 @@ event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: co
if ( chain_idx != 0 ) return;
local host = c$id$resp_h;
if ( [host, cert$serial] !in known_certs && addr_matches_host(host, asset_tracking) )
if ( [host, cert$serial] !in known_certs && addr_matches_host(host, cert_tracking) )
{
add known_certs[host, cert$serial];
Log::write(KNOWN_CERTS, [$ts=network_time(), $host=host,
$port_num=c$id$resp_p, $subject=cert$subject,
$issuer_subject=cert$issuer,
$serial=cert$serial]);
Log::write(Known::CERTS_LOG, [$ts=network_time(), $host=host,
$port_num=c$id$resp_p, $subject=cert$subject,
$issuer_subject=cert$issuer,
$serial=cert$serial]);
}
}

8
scripts/policy/tuning/track-all-assets.bro
View file

@ -3,7 +3,7 @@
@load protocols/conn/known-services
@load protocols/ssl/known-certs
redef Software::asset_tracking = ALL_HOSTS;
redef KnownHosts::asset_tracking = ALL_HOSTS;
redef KnownServices::asset_tracking = ALL_HOSTS;
redef KnownCerts::asset_tracking = ALL_HOSTS;
redef Software::asset_tracking = ALL_HOSTS;
redef Known::host_tracking = ALL_HOSTS;
redef Known::service_tracking = ALL_HOSTS;
redef Known::cert_tracking = ALL_HOSTS;