Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/seth/remove-dns-weird'

Browse source 
* origin/topic/seth/remove-dns-weird:
  Updated news.
  Remove some DNS weirds that caused volume and didn't help anyone.
This commit is contained in:
Jon Siwek 2017-12-15 15:08:51 -06:00
commit 1c25df6f26
5 changed files with 14 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,4 +1,10 @@
2.5-372 | 2017-12-15 15:08:51 -0600
* Remove some DNS weirds that caused volume and are generally not useful:
dns_unmatched_msg, dns_unmatched_msg_quantity, dns_unmatched_reply.
(Corelight)
2.5-369 | 2017-12-13 14:22:47 -0600
* Fix typo in analyzer::Manager API docs (Corelight)

3
NEWS
View file

@ -56,6 +56,9 @@ Changed Functionality
redef SOCKS::default_capture_password = T;
- The DNS base scripts no longer generate some noisy and annoying
weirds (dns_unmatched_msg, dns_unmatched_msg_quantity, dns_unmatched_reply)
Removed Functionality
---------------------

2
VERSION
View file

@ -1 +1 @@
2.5-369
2.5-372

14
scripts/base/protocols/dns/main.bro
View file

@ -2,7 +2,6 @@
##! their responses.
@load base/utils/queue
@load base/frameworks/notice/weird
@load ./consts
module DNS;
@ -177,9 +176,6 @@ function log_unmatched_msgs_queue(q: Queue::Queue)
for ( i in infos )
{
local wi = Weird::Info($ts=network_time(), $name="dns_unmatched_msg", $uid=infos[i]$uid,
$id=infos[i]$id);
Weird::weird(wi);
Log::write(DNS::LOG, infos[i]);
}
}
@ -187,21 +183,19 @@ function log_unmatched_msgs_queue(q: Queue::Queue)
function log_unmatched_msgs(msgs: PendingMessages)
{
for ( trans_id in msgs )
{
log_unmatched_msgs_queue(msgs[trans_id]);
}
clear_table(msgs);
}
function enqueue_new_msg(msgs: PendingMessages, id: count, msg: Info)
{
local wi: Weird::Info;
if ( id !in msgs )
{
if ( |msgs| > max_pending_query_ids )
{
wi = Weird::Info($ts=network_time(), $name="dns_unmatched_msg", $uid=msg$uid,
$id=msg$id);
Weird::weird(wi);
# Throw away all unmatched on assumption they'll never be matched.
log_unmatched_msgs(msgs);
}
@ -212,9 +206,6 @@ function enqueue_new_msg(msgs: PendingMessages, id: count, msg: Info)
{
if ( Queue::len(msgs[id]) > max_pending_msgs )
{
wi = Weird::Info($ts=network_time(), $name="dns_unmatched_msg_quantity", $uid=msg$uid,
$id=msg$id);
Weird::weird(wi);
log_unmatched_msgs_queue(msgs[id]);
# Throw away all unmatched on assumption they'll never be matched.
msgs[id] = Queue::init();
@ -271,7 +262,6 @@ hook set_session(c: connection, msg: dns_msg, is_query: bool) &priority=5
# Create a new DNS session and put it in the reply queue so
# we can wait for a matching query.
c$dns = new_session(c, msg$id);
event conn_weird("dns_unmatched_reply", c, "");
enqueue_new_msg(c$dns_state$pending_replies, msg$id, c$dns);
}
}

6
testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/weird.log
View file

@ -3,10 +3,8 @@
#empty_field (empty)
#unset_field -
#path weird
#open 2016-07-13-16-16-12
#open 2017-12-13-19-40-49
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string
1363716396.798286 CHhAvVGS1DHFjwGM9 55.247.223.174 27285 222.195.43.124 53 DNS_RR_unknown_type 46 F bro
1363716396.798374 CHhAvVGS1DHFjwGM9 55.247.223.174 27285 222.195.43.124 53 dns_unmatched_reply - F bro
1363716396.798374 CHhAvVGS1DHFjwGM9 55.247.223.174 27285 222.195.43.124 53 dns_unmatched_msg - F bro
#close 2016-07-13-16-16-12
#close 2017-12-13-19-40-49