Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Logging framework update and mass Log::ID renaming.

Browse source 
- Log path's are generated in the scripting land
  now.  The default Log stream ID to path string
  mapping works like this:
    - Notice::LOG -> "notice"
    - Notice::POLICY_LOG -> "notice_policy"
    - TestModule::LOG -> "test_module"

- Logging streams updated across all of the shipped
  scripts to be more user friendly.  Instead of
  the logging stream ID HTTP::HTTP, we now have
  HTTP::LOG, etc.

- The priorities on some bro_init handlers have
  been adjusted to make the process of applying
  filters or disabling streams easier for users.
This commit is contained in:
Seth Hall 2011-09-03 01:10:17 -04:00
parent fe53091cd1
commit 11c437faa3
77 changed files with 391 additions and 619 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/policy/protocols/conn/known-hosts.bro
View file

@ -5,10 +5,10 @@
@load base/utils/directions-and-hosts
module KnownHosts;
module Known;
export {
redef enum Log::ID += { KNOWN_HOSTS };
redef enum Log::ID += { HOSTS_LOG };
type Info: record {
## The timestamp at which the host was detected.
@ -20,7 +20,7 @@ export {
## The hosts whose existence should be logged and tracked.
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
const asset_tracking = LOCAL_HOSTS &redef;
const host_tracking = LOCAL_HOSTS &redef;
## The set of all known addresses to store for preventing duplicate
## logging of addresses. It can also be used from other scripts to
@ -34,7 +34,7 @@ export {
event bro_init()
{
Log::create_stream(KNOWN_HOSTS, [$columns=Info, $ev=log_known_hosts]);
Log::create_stream(Known::HOSTS_LOG, [$columns=Info, $ev=log_known_hosts]);
}
event connection_established(c: connection) &priority=5
@ -43,10 +43,10 @@ event connection_established(c: connection) &priority=5
for ( host in set(id$orig_h, id$resp_h) )
{
if ( host !in known_hosts && addr_matches_host(host, asset_tracking) )
if ( host !in known_hosts && addr_matches_host(host, host_tracking) )
{
add known_hosts[host];
Log::write(KNOWN_HOSTS, [$ts=network_time(), $host=host]);
Log::write(Known::HOSTS_LOG, [$ts=network_time(), $host=host]);
}
}
}

14
scripts/policy/protocols/conn/known-services.bro
View file

@ -5,9 +5,9 @@
@load base/utils/directions-and-hosts
module KnownServices;
module Known;
redef enum Log::ID += { KNOWN_SERVICES };
redef enum Log::ID += { SERVICES_LOG };
export {
type Info: record {
@ -21,7 +21,7 @@ export {
};
## The hosts whose services should be tracked and logged.
const asset_tracking = LOCAL_HOSTS &redef;
const service_tracking = LOCAL_HOSTS &redef;
global known_services: set[addr, port] &create_expire=1day &synchronized;
@ -35,8 +35,8 @@ redef record connection += {
event bro_init()
{
Log::create_stream(KNOWN_SERVICES, [$columns=Info,
$ev=log_known_services]);
Log::create_stream(Known::SERVICES_LOG, [$columns=Info,
$ev=log_known_services]);
}
function known_services_done(c: connection)
@ -44,7 +44,7 @@ function known_services_done(c: connection)
local id = c$id;
if ( ! c$known_services_done &&
get_port_transport_proto(id$resp_p) == tcp &&
addr_matches_host(id$resp_h, asset_tracking) &&
addr_matches_host(id$resp_h, service_tracking) &&
[id$resp_h, id$resp_p] !in known_services &&
"ftp-data" !in c$service ) # don't include ftp data sessions
{
@ -56,7 +56,7 @@ function known_services_done(c: connection)
i$service=c$service;
add known_services[id$resp_h, id$resp_p];
Log::write(KNOWN_SERVICES, i);
Log::write(Known::SERVICES_LOG, i);
c$known_services_done = T;
}
}

18
scripts/policy/protocols/ssl/known-certs.bro
View file

@ -1,9 +1,9 @@
@load base/utils/directions-and-hosts
module KnownCerts;
module Known;
export {
redef enum Log::ID += { KNOWN_CERTS };
redef enum Log::ID += { CERTS_LOG };
type Info: record {
## The timestamp when the certificate was detected.
@ -23,7 +23,7 @@ export {
## The certificates whose existence should be logged and tracked.
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS
const asset_tracking = LOCAL_HOSTS &redef;
const cert_tracking = LOCAL_HOSTS &redef;
## The set of all known certificates to store for preventing duplicate
## logging. It can also be used from other scripts to
@ -36,7 +36,7 @@ export {
event bro_init()
{
Log::create_stream(KNOWN_CERTS, [$columns=Info, $ev=log_known_certs]);
Log::create_stream(Known::CERTS_LOG, [$columns=Info, $ev=log_known_certs]);
}
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string)
@ -47,12 +47,12 @@ event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: co
if ( chain_idx != 0 ) return;
local host = c$id$resp_h;
if ( [host, cert$serial] !in known_certs && addr_matches_host(host, asset_tracking) )
if ( [host, cert$serial] !in known_certs && addr_matches_host(host, cert_tracking) )
{
add known_certs[host, cert$serial];
Log::write(KNOWN_CERTS, [$ts=network_time(), $host=host,
$port_num=c$id$resp_p, $subject=cert$subject,
$issuer_subject=cert$issuer,
$serial=cert$serial]);
Log::write(Known::CERTS_LOG, [$ts=network_time(), $host=host,
$port_num=c$id$resp_p, $subject=cert$subject,
$issuer_subject=cert$issuer,
$serial=cert$serial]);
}
}