mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Merge branch 'master' into topic/jsiwek/autodoc-fixes
Conflicts: scripts/CMakeLists.txt scripts/base/frameworks/cluster/setup-connections.bro scripts/base/frameworks/communication/__load__.bro scripts/base/frameworks/metrics/conn-example.bro scripts/base/frameworks/metrics/http-example.bro scripts/site/local.bro
This commit is contained in:
Jon Siwek
commit
2a9ea6b8ba
96 changed files with 1809 additions and 722 deletions
|
|
@ -1,17 +1,27 @@
|
|||
include(InstallPackageConfigFile)
|
||||
|
||||
install(DIRECTORY ./ DESTINATION ${BRO_SCRIPT_INSTALL_PATH} FILES_MATCHING
|
||||
PATTERN "all.bro" EXCLUDE
|
||||
PATTERN "site/local.bro" EXCLUDE
|
||||
PATTERN "site/local*" EXCLUDE
|
||||
PATTERN "*.bro"
|
||||
PATTERN "*.sig"
|
||||
PATTERN "*.osf"
|
||||
PATTERN "*.fp"
|
||||
)
|
||||
|
||||
# Install as a config file since the local.bro script is meant to be
|
||||
# Install all local* scripts as config files since they are meant to be
|
||||
# user modify-able.
|
||||
InstallPackageConfigFile(
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/site/local.bro
|
||||
${BRO_SCRIPT_INSTALL_PATH}/site
|
||||
local.bro)
|
||||
|
||||
InstallPackageConfigFile(
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/site/local-manager.bro
|
||||
${BRO_SCRIPT_INSTALL_PATH}/site
|
||||
local-manager.bro)
|
||||
InstallPackageConfigFile(
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/site/local-proxy.bro
|
||||
${BRO_SCRIPT_INSTALL_PATH}/site
|
||||
local-proxy.bro)
|
||||
InstallPackageConfigFile(
|
||||
${CMAKE_CURRENT_SOURCE_DIR}/site/local-worker.bro
|
||||
${BRO_SCRIPT_INSTALL_PATH}/site
|
||||
local-worker.bro)
|
||||
|
|
|
|||
|
|
@ -9,10 +9,6 @@ redef peer_description = Cluster::node;
|
|||
# Add a cluster prefix.
|
||||
@prefixes += cluster
|
||||
|
||||
# Make this a controllable node since all cluster nodes are inherently
|
||||
# controllable.
|
||||
@load frameworks/control/controllee
|
||||
|
||||
## If this script isn't found anywhere, the cluster bombs out.
|
||||
## Loading the cluster framework requires that a script by this name exists
|
||||
## somewhere in the BROPATH. The only thing in the file should be the
|
||||
|
|
|
|||
|
|
@ -10,11 +10,14 @@
|
|||
|
||||
@prefixes += cluster-manager
|
||||
|
||||
## Load the script for local site configuration for the manager node.
|
||||
@load site/local-manager
|
||||
|
||||
## Turn off remote logging since this is the manager and should only log here.
|
||||
redef Log::enable_remote_logging = F;
|
||||
|
||||
## Use the cluster's archive logging script.
|
||||
redef Log::default_rotation_postprocessor = "archive-log";
|
||||
redef Log::default_rotation_postprocessor_cmd = "archive-log";
|
||||
|
||||
## We're processing essentially *only* remote events.
|
||||
redef max_remote_events_processed = 10000;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
|
||||
@prefixes += cluster-proxy
|
||||
|
||||
## Load the script for local site configuration for proxy nodes.
|
||||
@load site/local-proxy
|
||||
|
||||
## The proxy only syncs state; does not forward events.
|
||||
redef forward_remote_events = F;
|
||||
redef forward_remote_state_changes = T;
|
||||
|
|
@ -12,5 +15,5 @@ redef Log::enable_local_logging = F;
|
|||
redef Log::enable_remote_logging = T;
|
||||
|
||||
## Use the cluster's delete-log script.
|
||||
redef Log::default_rotation_postprocessor = "delete-log";
|
||||
redef Log::default_rotation_postprocessor_cmd = "delete-log";
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
|
||||
@prefixes += cluster-worker
|
||||
|
||||
## Load the script for local site configuration for the worker nodes.
|
||||
@load site/local-worker
|
||||
|
||||
## Don't do any local logging.
|
||||
redef Log::enable_local_logging = F;
|
||||
|
||||
|
|
@ -8,7 +11,7 @@ redef Log::enable_local_logging = F;
|
|||
redef Log::enable_remote_logging = T;
|
||||
|
||||
## Use the cluster's delete-log script.
|
||||
redef Log::default_rotation_postprocessor = "delete-log";
|
||||
redef Log::default_rotation_postprocessor_cmd = "delete-log";
|
||||
|
||||
## Record all packets into trace file.
|
||||
# TODO: should we really be setting this to T?
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
@load base/frameworks/communication
|
||||
@load ./main
|
||||
@load base/frameworks/communication/main
|
||||
|
||||
module Cluster;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1 @@
|
|||
|
||||
# TODO: get rid of this as soon as the Expr.cc hack is changed.
|
||||
@if ( getenv("ENABLE_COMMUNICATION") != "" )
|
||||
@load ./main
|
||||
@endif
|
||||
|
|
|
|||
|
|
@ -108,6 +108,9 @@ const src_names = {
|
|||
event bro_init()
|
||||
{
|
||||
Log::create_stream(COMMUNICATION, [$columns=Info]);
|
||||
|
||||
if ( |nodes| > 0 )
|
||||
enable_communication();
|
||||
}
|
||||
|
||||
function do_script_log_common(level: count, src: count, msg: string)
|
||||
|
|
|
|||
|
|
@ -27,6 +27,17 @@ export {
|
|||
ev: any &optional;
|
||||
};
|
||||
|
||||
## Default function for building the path values for log filters if not
|
||||
## speficied otherwise by a filter. The default implementation uses ``id``
|
||||
## to derive a name.
|
||||
##
|
||||
## id: The log stream.
|
||||
## path: A suggested path value, which may be either the filter's ``path``
|
||||
## if defined or a fall-back generated internally.
|
||||
##
|
||||
## Returns: The path to be used for the filter.
|
||||
global default_path_func: function(id: ID, path: string) : string &redef;
|
||||
|
||||
## Filter customizing logging.
|
||||
type Filter: record {
|
||||
## Descriptive name to reference this filter.
|
||||
|
|
@ -50,7 +61,7 @@ export {
|
|||
## The specific interpretation of the string is up to
|
||||
## the used writer, and may for example be the destination
|
||||
## file name. Generally, filenames are expected to given
|
||||
## without any extensions; writers will add appropiate
|
||||
## without any extensions; writers will add appropiate
|
||||
## extensions automatically.
|
||||
path: string &optional;
|
||||
|
||||
|
|
@ -81,36 +92,34 @@ export {
|
|||
|
||||
## Information passed into rotation callback functions.
|
||||
type RotationInfo: record {
|
||||
writer: Writer; ##< Writer.
|
||||
path: string; ##< Original path value.
|
||||
open: time; ##< Time when opened.
|
||||
close: time; ##< Time when closed.
|
||||
writer: Writer; ##< Writer.
|
||||
fname: string; ##< Full name of the rotated file.
|
||||
path: string; ##< Original path value.
|
||||
open: time; ##< Time when opened.
|
||||
close: time; ##< Time when closed.
|
||||
terminating: bool; ##< True if rotation occured due to Bro shutting down.
|
||||
};
|
||||
|
||||
## Default rotation interval. Zero disables rotation.
|
||||
const default_rotation_interval = 0secs &redef;
|
||||
|
||||
## Default naming suffix format. Uses a strftime() style.
|
||||
const default_rotation_date_format = "%y-%m-%d_%H.%M.%S" &redef;
|
||||
## Default naming format for timestamps embedded into filenames. Uses a strftime() style.
|
||||
const default_rotation_date_format = "%Y-%m-%d-%H-%M-%S" &redef;
|
||||
|
||||
## Default postprocessor for writers outputting into files.
|
||||
const default_rotation_postprocessor = "" &redef;
|
||||
## Default shell command to run on rotated files. Empty for none.
|
||||
const default_rotation_postprocessor_cmd = "" &redef;
|
||||
|
||||
## Default function to construct the name of a rotated output file.
|
||||
## The default implementation appends info$date_fmt to the original
|
||||
## file name.
|
||||
##
|
||||
## info: Meta-data about the file to be rotated.
|
||||
global default_rotation_path_func: function(info: RotationInfo) : string &redef;
|
||||
## Specifies the default postprocessor function per writer type. Entries in this
|
||||
## table are initialized by each writer type.
|
||||
const default_rotation_postprocessors: table[Writer] of function(info: RotationInfo) : bool &redef;
|
||||
|
||||
## Type for controlling file rotation.
|
||||
type RotationControl: record {
|
||||
## Rotation interval.
|
||||
interv: interval &default=default_rotation_interval;
|
||||
## Format for timestamps embedded into rotated file names.
|
||||
date_fmt: string &default=default_rotation_date_format;
|
||||
## Postprocessor process to run on rotate file.
|
||||
postprocessor: string &default=default_rotation_postprocessor;
|
||||
## Callback function to trigger for rotated files. If not set, the default
|
||||
## comes out of default_rotation_postprocessors.
|
||||
postprocessor: function(info: RotationInfo) : bool &optional;
|
||||
};
|
||||
|
||||
## Specifies rotation parameters per ``(id, path)`` tuple.
|
||||
|
|
@ -133,6 +142,8 @@ export {
|
|||
global flush: function(id: ID): bool;
|
||||
global add_default_filter: function(id: ID) : bool;
|
||||
global remove_default_filter: function(id: ID) : bool;
|
||||
|
||||
global run_rotation_postprocessor_cmd: function(info: RotationInfo, npath: string) : bool;
|
||||
}
|
||||
|
||||
# We keep a script-level copy of all filters so that we can manipulate them.
|
||||
|
|
@ -140,10 +151,39 @@ global filters: table[ID, string] of Filter;
|
|||
|
||||
@load logging.bif.bro # Needs Filter and Stream defined.
|
||||
|
||||
function default_rotation_path_func(info: RotationInfo) : string
|
||||
module Log;
|
||||
|
||||
# Used internally by the log manager.
|
||||
function __default_rotation_postprocessor(info: RotationInfo) : bool
|
||||
{
|
||||
local date_fmt = rotation_control[info$writer, info$path]$date_fmt;
|
||||
return fmt("%s-%s", info$path, strftime(date_fmt, info$open));
|
||||
if ( info$writer in default_rotation_postprocessors )
|
||||
return default_rotation_postprocessors[info$writer](info);
|
||||
}
|
||||
|
||||
function default_path_func(id: ID, path: string) : string
|
||||
{
|
||||
# TODO for Seth: Do what you want. :)
|
||||
return path;
|
||||
}
|
||||
|
||||
# Run post-processor on file. If there isn't any postprocessor defined,
|
||||
# we move the file to a nicer name.
|
||||
function run_rotation_postprocessor_cmd(info: RotationInfo, npath: string) : bool
|
||||
{
|
||||
local pp_cmd = default_rotation_postprocessor_cmd;
|
||||
|
||||
if ( pp_cmd == "" )
|
||||
return T;
|
||||
|
||||
# The date format is hard-coded here to provide a standardized
|
||||
# script interface.
|
||||
system(fmt("%s %s %s %s %s %d",
|
||||
pp_cmd, npath, info$path,
|
||||
strftime("%y-%m-%d_%H.%M.%S", info$open),
|
||||
strftime("%y-%m-%d_%H.%M.%S", info$close),
|
||||
info$terminating));
|
||||
|
||||
return T;
|
||||
}
|
||||
|
||||
function create_stream(id: ID, stream: Stream) : bool
|
||||
|
|
@ -159,9 +199,15 @@ function disable_stream(id: ID) : bool
|
|||
if ( ! __disable_stream(id) )
|
||||
return F;
|
||||
}
|
||||
|
||||
|
||||
function add_filter(id: ID, filter: Filter) : bool
|
||||
{
|
||||
# This is a work-around for the fact that we can't forward-declare
|
||||
# the default_path_func and then use it as &default in the record
|
||||
# definition.
|
||||
if ( ! filter?$path_func )
|
||||
filter$path_func = default_path_func;
|
||||
|
||||
filters[id, filter$name] = filter;
|
||||
return __add_filter(id, filter);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -26,4 +26,19 @@ export {
|
|||
const unset_field = "-" &redef;
|
||||
}
|
||||
|
||||
# Default function to postprocess a rotated ASCII log file. It moves the rotated
|
||||
# file to a new name that includes a timestamp with the opening time, and then
|
||||
# runs the writer's default postprocessor command on it.
|
||||
function default_rotation_postprocessor_func(info: Log::RotationInfo) : bool
|
||||
{
|
||||
# Move file to name including both opening and closing time.
|
||||
local dst = fmt("%s.%s.log", info$path,
|
||||
strftime(Log::default_rotation_date_format, info$open));
|
||||
|
||||
system(fmt("/bin/mv %s %s", info$fname, dst));
|
||||
|
||||
# Run default postprocessor.
|
||||
return Log::run_rotation_postprocessor_cmd(info, dst);
|
||||
}
|
||||
|
||||
redef Log::default_rotation_postprocessors += { [Log::WRITER_ASCII] = default_rotation_postprocessor_func };
|
||||
|
|
|
|||
|
|
@ -1,19 +0,0 @@
|
|||
@load base/frameworks/metrics
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
CONNS_ORIGINATED,
|
||||
CONNS_RESPONDED
|
||||
};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Metrics::configure(CONNS_ORIGINATED, [$aggregation_mask=24, $break_interval=5mins]);
|
||||
Metrics::configure(CONNS_RESPONDED, [$aggregation_mask=24, $break_interval=5mins]);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
Metrics::add_data(CONNS_ORIGINATED, [$host=c$id$orig_h], 1);
|
||||
Metrics::add_data(CONNS_RESPONDED, [$host=c$id$resp_h], 1);
|
||||
}
|
||||
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
@load base/frameworks/metrics
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
HTTP_REQUESTS_BY_STATUS_CODE,
|
||||
HTTP_REQUESTS_BY_HOST,
|
||||
};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Metrics::configure(HTTP_REQUESTS_BY_STATUS_CODE, [$aggregation_mask=24, $break_interval=10secs]);
|
||||
Metrics::configure(HTTP_REQUESTS_BY_HOST, [$break_interval=10secs]);
|
||||
}
|
||||
|
||||
event HTTP::log_http(rec: HTTP::Info)
|
||||
{
|
||||
if ( rec?$host )
|
||||
Metrics::add_data(HTTP_REQUESTS_BY_HOST, [$index=rec$host], 1);
|
||||
if ( rec?$status_code )
|
||||
Metrics::add_data(HTTP_REQUESTS_BY_STATUS_CODE, [$host=rec$id$orig_h, $index=fmt("%d", rec$status_code)], 1);
|
||||
}
|
||||
|
|
@ -1,30 +1,28 @@
|
|||
##! This is the implementation of the metrics framework
|
||||
##! This is the implementation of the metrics framework.
|
||||
|
||||
module Metrics;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { METRICS };
|
||||
|
||||
|
||||
type ID: enum {
|
||||
ALL,
|
||||
NOTHING,
|
||||
};
|
||||
|
||||
const default_aggregation_mask = 24 &redef;
|
||||
const default_break_interval = 5mins &redef;
|
||||
## The default interval used for "breaking" metrics and writing the
|
||||
## current value to the logging stream.
|
||||
const default_break_interval = 15mins &redef;
|
||||
|
||||
# TODO: configure a metrics filter logging stream to log the current
|
||||
# metrics configuration in case someone is looking through
|
||||
# old logs and the configuration has changed since then.
|
||||
type Filter: record {
|
||||
name: ID &optional;
|
||||
## Global mask by which you'd like to aggregate traffic.
|
||||
aggregation_mask: count &optional;
|
||||
## This is essentially applying names to various subnets.
|
||||
aggregation_table: table[subnet] of string &optional;
|
||||
break_interval: interval &default=default_break_interval;
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
metric_id: ID &log;
|
||||
filter_name: string &log;
|
||||
agg_subnet: string &log &optional;
|
||||
index: string &log &optional;
|
||||
value: count &log;
|
||||
};
|
||||
|
||||
type Index: record {
|
||||
type Entry: record {
|
||||
## Host is the value to which this metric applies.
|
||||
host: addr &optional;
|
||||
|
||||
|
|
@ -36,36 +34,71 @@ export {
|
|||
## metric since multiple IP addresses could respond for the same Host
|
||||
## header value.
|
||||
index: string &default="";
|
||||
|
||||
## The value by which the counter should be increased in each filter
|
||||
## where this entry is accepted.
|
||||
increment: count &default=1;
|
||||
};
|
||||
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
name: ID &log;
|
||||
index: string &log &optional;
|
||||
agg_subnet: string &log &optional;
|
||||
value: count &log;
|
||||
# TODO: configure a metrics filter logging stream to log the current
|
||||
# metrics configuration in case someone is looking through
|
||||
# old logs and the configuration has changed since then.
|
||||
type Filter: record {
|
||||
## The :bro:type:`Metrics::ID` that this filter applies to.
|
||||
id: ID &optional;
|
||||
## The name for this filter so that multiple filters can be
|
||||
## applied to a single metrics to get a different view of the same
|
||||
## metric data being collected (different aggregation, break, etc).
|
||||
name: string &default="default";
|
||||
## A predicate so that you can decide per index if you would like
|
||||
## to accept the data being inserted.
|
||||
pred: function(entry: Entry): bool &optional;
|
||||
## Global mask by which you'd like to aggregate traffic.
|
||||
aggregation_mask: count &optional;
|
||||
## This is essentially applying names to various subnets.
|
||||
aggregation_table: table[subnet] of string &optional;
|
||||
## The interval at which the metric should be "broken" and written
|
||||
## to the logging stream.
|
||||
break_interval: interval &default=default_break_interval;
|
||||
## This determines if the result of this filter is sent to the metrics
|
||||
## logging stream. One use for the logging framework is as an internal
|
||||
## thresholding and statistics gathering utility that is meant to
|
||||
## never log but rather to generate notices and derive data.
|
||||
log: bool &default=T;
|
||||
## A straight threshold for generating a notice.
|
||||
notice_threshold: count &optional;
|
||||
## A series of thresholds at which to generate notices.
|
||||
notice_thresholds: vector of count &optional;
|
||||
## If this and a $notice_threshold value are set, this notice type
|
||||
## will be generated by the metrics framework.
|
||||
note: Notice::Type &optional;
|
||||
};
|
||||
|
||||
global add_filter: function(name: ID, filter: Filter);
|
||||
global add_data: function(name: ID, index: Index, increment: count);
|
||||
global add_filter: function(id: ID, filter: Filter);
|
||||
global add_data: function(id: ID, entry: Entry);
|
||||
|
||||
global log_metrics: event(rec: Info);
|
||||
}
|
||||
|
||||
global metric_filters: table[ID] of Filter = table();
|
||||
global metric_filters: table[ID] of vector of Filter = table();
|
||||
|
||||
type MetricIndex: table[string] of count &default=0;
|
||||
type MetricTable: table[string] of MetricIndex;
|
||||
global store: table[ID] of MetricTable = table();
|
||||
# This is indexed by metric ID and stream filter name.
|
||||
global store: table[ID, string] of MetricTable = table();
|
||||
|
||||
event bro_init()
|
||||
# This stores the current threshold index for filters using the
|
||||
# $notice_thresholds element.
|
||||
global thresholds: table[string] of count = {} &default=0;
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(METRICS, [$columns=Info, $ev=log_metrics]);
|
||||
}
|
||||
|
||||
function reset(name: ID)
|
||||
function reset(filter: Filter)
|
||||
{
|
||||
store[name] = table();
|
||||
store[filter$id, filter$name] = table();
|
||||
}
|
||||
|
||||
event log_it(filter: Filter)
|
||||
|
|
@ -73,70 +106,128 @@ event log_it(filter: Filter)
|
|||
# If this node is the manager in a cluster, this needs to request values
|
||||
# for this metric from all of the workers.
|
||||
|
||||
local id = filter$id;
|
||||
local name = filter$name;
|
||||
for ( agg_subnet in store[name] )
|
||||
for ( agg_subnet in store[id, name] )
|
||||
{
|
||||
local metric_values = store[name][agg_subnet];
|
||||
local metric_values = store[id, name][agg_subnet];
|
||||
for ( index in metric_values )
|
||||
{
|
||||
local val = metric_values[index];
|
||||
local m: Info = [$ts=network_time(),
|
||||
$name=name,
|
||||
$agg_subnet=fmt("%s", agg_subnet),
|
||||
$index=index,
|
||||
$metric_id=id,
|
||||
$filter_name=name,
|
||||
$agg_subnet=fmt("%s", agg_subnet),
|
||||
$index=index,
|
||||
$value=val];
|
||||
|
||||
if ( filter?$notice_threshold &&
|
||||
m$value >= filter$notice_threshold )
|
||||
{
|
||||
print m;
|
||||
NOTICE([$note=filter$note,
|
||||
$msg=fmt("Metrics threshold crossed by %s %d/%d", m$agg_subnet, m$value, filter$notice_threshold),
|
||||
$n=m$value]);
|
||||
}
|
||||
|
||||
else if ( filter?$notice_thresholds &&
|
||||
m$value >= filter$notice_thresholds[thresholds[cat(id,name)]] )
|
||||
{
|
||||
# TODO: implement this
|
||||
}
|
||||
|
||||
# If there wasn't an index, remove the field.
|
||||
if ( index == "" )
|
||||
delete m$index;
|
||||
|
||||
# If there wasn't an aggregation subnet, remove the field.
|
||||
if ( agg_subnet == "" )
|
||||
delete m$agg_subnet;
|
||||
|
||||
Log::write(METRICS, m);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
reset(name);
|
||||
reset(filter);
|
||||
|
||||
schedule filter$break_interval { log_it(filter) };
|
||||
}
|
||||
|
||||
function add_filter(name: ID, filter: Filter)
|
||||
function add_filter(id: ID, filter: Filter)
|
||||
{
|
||||
if ( filter?$aggregation_table && filter?$aggregation_mask )
|
||||
{
|
||||
print "INVALID Metric filter: Defined $aggregation_table and $aggregation_mask.";
|
||||
return;
|
||||
}
|
||||
if ( [id, filter$name] in store )
|
||||
{
|
||||
print fmt("INVALID Metric filter: Filter with name \"%s\" already exists.", filter$name);
|
||||
return;
|
||||
}
|
||||
if ( filter?$notice_threshold && filter?$notice_thresholds )
|
||||
{
|
||||
print "INVALID Metric filter: Defined both $notice_threshold and $notice_thresholds";
|
||||
return;
|
||||
}
|
||||
|
||||
filter$name = name;
|
||||
metric_filters[name] = filter;
|
||||
store[name] = table();
|
||||
if ( ! filter?$id )
|
||||
filter$id = id;
|
||||
|
||||
if ( id !in metric_filters )
|
||||
metric_filters[id] = vector();
|
||||
metric_filters[id][|metric_filters[id]|] = filter;
|
||||
|
||||
store[id, filter$name] = table();
|
||||
|
||||
# Only do this on the manager if in a cluster.
|
||||
schedule filter$break_interval { log_it(filter) };
|
||||
}
|
||||
|
||||
function add_data(name: ID, index: Index, increment: count)
|
||||
function add_data(id: ID, entry: Entry)
|
||||
{
|
||||
local conf = metric_filters[name];
|
||||
|
||||
local agg_subnet = "";
|
||||
if ( index?$host )
|
||||
if ( id !in metric_filters )
|
||||
return;
|
||||
|
||||
local filters = metric_filters[id];
|
||||
|
||||
# Add the data to any of the defined filters.
|
||||
for ( filter_id in filters )
|
||||
{
|
||||
if ( conf?$aggregation_mask )
|
||||
local filter = filters[filter_id];
|
||||
|
||||
# If this filter has a predicate, run the predicate and skip this
|
||||
# entry if the predicate return false.
|
||||
if ( filter?$pred &&
|
||||
! filter$pred(entry) )
|
||||
next;
|
||||
|
||||
local agg_subnet = "";
|
||||
local filt_store = store[id, filter$name];
|
||||
if ( entry?$host )
|
||||
{
|
||||
local agg_mask = conf$aggregation_mask;
|
||||
agg_subnet = fmt("%s", mask_addr(index$host, agg_mask));
|
||||
if ( filter?$aggregation_mask )
|
||||
{
|
||||
local agg_mask = filter$aggregation_mask;
|
||||
agg_subnet = fmt("%s", mask_addr(entry$host, agg_mask));
|
||||
}
|
||||
else if ( filter?$aggregation_table )
|
||||
{
|
||||
agg_subnet = fmt("%s", filter$aggregation_table[entry$host]);
|
||||
# if an aggregation table is being used and the value isn't
|
||||
# in the table, that means we aren't interested in it.
|
||||
if ( agg_subnet == "" )
|
||||
next;
|
||||
}
|
||||
else
|
||||
agg_subnet = fmt("%s", entry$host);
|
||||
}
|
||||
else if ( conf?$aggregation_table )
|
||||
agg_subnet = fmt("%s", conf$aggregation_table[index$host]);
|
||||
else
|
||||
agg_subnet = fmt("%s", index$host);
|
||||
|
||||
if ( agg_subnet !in filt_store )
|
||||
filt_store[agg_subnet] = table();
|
||||
|
||||
local fs = filt_store[agg_subnet];
|
||||
if ( entry$index !in fs )
|
||||
fs[entry$index] = 0;
|
||||
fs[entry$index] = fs[entry$index] + entry$increment;
|
||||
}
|
||||
|
||||
if ( agg_subnet !in store[name] )
|
||||
store[name][agg_subnet] = table();
|
||||
|
||||
if ( index$index !in store[name][agg_subnet] )
|
||||
store[name][agg_subnet][index$index] = 0;
|
||||
store[name][agg_subnet][index$index] = store[name][agg_subnet][index$index] + increment;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,7 +6,8 @@
|
|||
@load ./actions/drop
|
||||
@load ./actions/email_admin
|
||||
@load ./actions/page
|
||||
@load ./actions/add-geodata
|
||||
|
||||
# Load the script to add hostnames to emails by default.
|
||||
# NOTE: this exposes a memleak in async DNS lookups.
|
||||
#@load ./extend-email/hostnames
|
||||
# There shouldn't be any defaul toverhead from loading these since they
|
||||
# *should* only do anything when notices have the ACTION_EMAIL action applied.
|
||||
@load ./extend-email/hostnames
|
||||
|
|
|
|||
47
scripts/base/frameworks/notice/actions/add-geodata.bro
Normal file
47
scripts/base/frameworks/notice/actions/add-geodata.bro
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
##! This script adds geographic location data to notices for the "remote"
|
||||
##! host in a connection. It does make the assumption that one of the
|
||||
##! addresses in a connection is "local" and one is "remote" which is
|
||||
##! probably a safe assumption to make in most cases. If both addresses
|
||||
##! are remote, it will use the $src address.
|
||||
|
||||
module Notice;
|
||||
|
||||
export {
|
||||
redef enum Action += {
|
||||
## Indicates that the notice should have geodata added for the
|
||||
## "remote" host. :bro:id:`Site::local_nets` must be defined
|
||||
## in order for this to work.
|
||||
ACTION_ADD_GEODATA
|
||||
};
|
||||
|
||||
redef record Info += {
|
||||
## If libGeoIP support is built in, notices can have geographic
|
||||
## information attached to them.
|
||||
remote_location: geo_location &log &optional;
|
||||
};
|
||||
|
||||
## Notice types which should have the "remote" location looked up.
|
||||
## If GeoIP support is not built in, this does nothing.
|
||||
const lookup_location_types: set[Notice::Type] = {} &redef;
|
||||
|
||||
## Add a helper to the notice policy for looking up GeoIP data.
|
||||
redef Notice::policy += {
|
||||
[$pred(n: Notice::Info) = { return (n$note in Notice::lookup_location_types); },
|
||||
$priority = 10],
|
||||
};
|
||||
}
|
||||
|
||||
# This is handled at a high priority in case other notice handlers
|
||||
# want to use the data.
|
||||
event notice(n: Notice::Info) &priority=10
|
||||
{
|
||||
if ( ACTION_ADD_GEODATA in n$actions &&
|
||||
|Site::local_nets| > 0 &&
|
||||
! n?$remote_location )
|
||||
{
|
||||
if ( n?$src && ! Site::is_local_addr(n$src) )
|
||||
n$remote_location = lookup_location(n$src);
|
||||
else if ( n?$dst && ! Site::is_local_addr(n$dst) )
|
||||
n$remote_location = lookup_location(n$dst);
|
||||
}
|
||||
}
|
||||
|
|
@ -509,7 +509,7 @@ const tunnel_port = 0/udp &redef;
|
|||
# packets and IP-level bytes transfered by each endpoint. If
|
||||
# true, these values are returned in the connection's endpoint
|
||||
# record val.
|
||||
const use_conn_size_analyzer = F &redef;
|
||||
const use_conn_size_analyzer = T &redef;
|
||||
|
||||
const UDP_INACTIVE = 0;
|
||||
const UDP_ACTIVE = 1; # means we've seen something from this endpoint
|
||||
|
|
|
|||
|
|
@ -214,7 +214,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
|
|||
c$http$response_content_length = extract_count(value);
|
||||
else if ( name == "CONTENT-DISPOSITION" &&
|
||||
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in value )
|
||||
c$http$filename = sub(value, /^.*[fF][iI][lL][eE][nN][aA][mM][eE]=/, "");
|
||||
c$http$filename = extract_filename_from_content_disposition(value);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -16,11 +16,13 @@ export {
|
|||
extract_file: bool &default=F;
|
||||
|
||||
## Store the file handle here for the file currently being extracted.
|
||||
extraction_file: file &optional;
|
||||
|
||||
extraction_file: file &log &optional;
|
||||
};
|
||||
|
||||
redef record State += {
|
||||
## Store a count of the number of files that have been transferred in
|
||||
## this conversation to create unique file names on disk.
|
||||
num_extracted_files: count &optional;
|
||||
num_extracted_files: count &default=0;
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -34,7 +36,7 @@ event mime_segment_data(c: connection, length: count, data: string) &priority=3
|
|||
{
|
||||
if ( c$mime$extract_file && c$mime$content_len == 0 )
|
||||
{
|
||||
local suffix = fmt("%d.dat", ++c$mime$num_extracted_files);
|
||||
local suffix = fmt("%d.dat", ++c$mime_state$num_extracted_files);
|
||||
local fname = generate_extraction_filename(extraction_prefix, c, suffix);
|
||||
c$mime$extraction_file = open(fname);
|
||||
enable_raw_output(c$mime$extraction_file);
|
||||
|
|
|
|||
|
|
@ -1 +1,3 @@
|
|||
@load ./main
|
||||
@load ./entities
|
||||
@load ./entities-excerpt
|
||||
52
scripts/base/protocols/smtp/entities-excerpt.bro
Normal file
52
scripts/base/protocols/smtp/entities-excerpt.bro
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
##! This script is for optionally adding a body excerpt to the SMTP
|
||||
##! entities log.
|
||||
|
||||
@load ./entities
|
||||
|
||||
module SMTP;
|
||||
|
||||
export {
|
||||
redef record SMTP::EntityInfo += {
|
||||
## The entity body excerpt.
|
||||
excerpt: string &log &default="";
|
||||
|
||||
## Internal tracking to know how much of the body should be included
|
||||
## in the excerpt.
|
||||
excerpt_len: count &optional;
|
||||
};
|
||||
|
||||
## This is the default value for how much of the entity body should be
|
||||
## included for all MIME entities.
|
||||
const default_entity_excerpt_len = 0 &redef;
|
||||
|
||||
## This table defines how much of various entity bodies should be
|
||||
## included in excerpts.
|
||||
const entity_excerpt_len: table[string] of count = {}
|
||||
&redef
|
||||
&default = default_entity_excerpt_len;
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=-1
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
if ( c$smtp$current_entity$content_len == 0 )
|
||||
c$smtp$current_entity$excerpt_len = entity_excerpt_len[c$smtp$current_entity$mime_type];
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=-2
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
local ent = c$smtp$current_entity;
|
||||
if ( ent$content_len < ent$excerpt_len )
|
||||
{
|
||||
if ( ent$content_len + length < ent$excerpt_len )
|
||||
ent$excerpt = cat(ent$excerpt, data);
|
||||
else
|
||||
{
|
||||
local x_bytes = ent$excerpt_len - ent$content_len;
|
||||
ent$excerpt = cat(ent$excerpt, sub_bytes(data, 1, x_bytes));
|
||||
}
|
||||
}
|
||||
}
|
||||
234
scripts/base/protocols/smtp/entities.bro
Normal file
234
scripts/base/protocols/smtp/entities.bro
Normal file
|
|
@ -0,0 +1,234 @@
|
|||
##! Analysis and logging for MIME entities found in SMTP sessions.
|
||||
|
||||
@load base/utils/strings
|
||||
@load base/utils/files
|
||||
@load ./main
|
||||
|
||||
module SMTP;
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## Indicates that an MD5 sum was calculated for a MIME message.
|
||||
MD5,
|
||||
};
|
||||
|
||||
redef enum Log::ID += { SMTP_ENTITIES };
|
||||
|
||||
type EntityInfo: record {
|
||||
## This is the timestamp of when the MIME content transfer began.
|
||||
ts: time &log;
|
||||
uid: string &log;
|
||||
id: conn_id &log;
|
||||
## Internally generated "message id" that ties back to the particular
|
||||
## message in the SMTP log where this entity was seen.
|
||||
mid: string &log;
|
||||
## The filename seen in the Content-Disposition header.
|
||||
filename: string &log &optional;
|
||||
## Track how many bytes of the MIME encoded file have been seen.
|
||||
content_len: count &log &default=0;
|
||||
## The mime type of the entity discovered through magic bytes identification.
|
||||
mime_type: string &log &optional;
|
||||
|
||||
## The calculated MD5 sum for the MIME entity.
|
||||
md5: string &log &optional;
|
||||
## Optionally calculate the file's MD5 sum. Must be set prior to the
|
||||
## first data chunk being see in an event.
|
||||
calc_md5: bool &default=F;
|
||||
## This boolean value indicates if an MD5 sum is being calculated
|
||||
## for the current file transfer.
|
||||
calculating_md5: bool &default=F;
|
||||
|
||||
## Optionally write the file to disk. Must be set prior to first
|
||||
## data chunk being seen in an event.
|
||||
extract_file: bool &default=F;
|
||||
## Store the file handle here for the file currently being extracted.
|
||||
extraction_file: file &log &optional;
|
||||
};
|
||||
|
||||
redef record Info += {
|
||||
## The in-progress entity information.
|
||||
current_entity: EntityInfo &optional;
|
||||
};
|
||||
|
||||
redef record State += {
|
||||
## Store a count of the number of files that have been transferred in
|
||||
## a conversation to create unique file names on disk.
|
||||
num_extracted_files: count &default=0;
|
||||
## Track the number of MIME encoded files transferred during a session.
|
||||
mime_level: count &default=0;
|
||||
};
|
||||
|
||||
## Generate MD5 sums for these filetypes.
|
||||
const generate_md5 = /application\/x-dosexec/ # Windows and DOS executables
|
||||
| /application\/x-executable/ # *NIX executable binary
|
||||
&redef;
|
||||
|
||||
## Pattern of file mime types to extract from MIME bodies.
|
||||
const extract_file_types = /NO_DEFAULT/ &redef;
|
||||
|
||||
## The on-disk prefix for files to be extracted from MIME entity bodies.
|
||||
const extraction_prefix = "smtp-entity" &redef;
|
||||
|
||||
global log_mime: event(rec: EntityInfo);
|
||||
}
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(SMTP_ENTITIES, [$columns=EntityInfo, $ev=log_mime]);
|
||||
}
|
||||
|
||||
function set_session(c: connection, new_entity: bool)
|
||||
{
|
||||
if ( ! c$smtp?$current_entity || new_entity )
|
||||
{
|
||||
local info: EntityInfo;
|
||||
info$ts=network_time();
|
||||
info$uid=c$uid;
|
||||
info$id=c$id;
|
||||
info$mid=c$smtp$mid;
|
||||
|
||||
c$smtp$current_entity = info;
|
||||
++c$smtp_state$mime_level;
|
||||
}
|
||||
}
|
||||
|
||||
event mime_begin_entity(c: connection) &priority=10
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
set_session(c, T);
|
||||
}
|
||||
|
||||
# This has priority -10 because other handlers need to know the current
|
||||
# content_len before it's updated by this handler.
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=-10
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
c$smtp$current_entity$content_len = c$smtp$current_entity$content_len + length;
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=7
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
if ( c$smtp$current_entity$content_len == 0 )
|
||||
c$smtp$current_entity$mime_type = split1(identify_data(data, T), /;/)[1];
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=-5
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
if ( c$smtp$current_entity$content_len == 0 )
|
||||
{
|
||||
if ( generate_md5 in c$smtp$current_entity$mime_type )
|
||||
c$smtp$current_entity$calc_md5 = T;
|
||||
|
||||
if ( c$smtp$current_entity$calc_md5 )
|
||||
{
|
||||
c$smtp$current_entity$calculating_md5 = T;
|
||||
md5_hash_init(c$id);
|
||||
}
|
||||
}
|
||||
|
||||
if ( c$smtp$current_entity$calculating_md5 )
|
||||
md5_hash_update(c$id, data);
|
||||
}
|
||||
|
||||
## In the event of a content gap during the MIME transfer, detect the state for
|
||||
## the MD5 sum calculation and stop calculating the MD5 since it would be
|
||||
## incorrect anyway.
|
||||
event content_gap(c: connection, is_orig: bool, seq: count, length: count) &priority=5
|
||||
{
|
||||
if ( is_orig || ! c?$smtp || ! c$smtp?$current_entity ) return;
|
||||
|
||||
if ( c$smtp$current_entity$calculating_md5 )
|
||||
{
|
||||
c$smtp$current_entity$calculating_md5 = F;
|
||||
md5_hash_finish(c$id);
|
||||
}
|
||||
}
|
||||
|
||||
event mime_end_entity(c: connection) &priority=-3
|
||||
{
|
||||
# TODO: this check is only due to a bug in mime_end_entity that
|
||||
# causes the event to be generated twice for the same real event.
|
||||
if ( ! c?$smtp || ! c$smtp?$current_entity )
|
||||
return;
|
||||
|
||||
if ( c$smtp$current_entity$calculating_md5 )
|
||||
{
|
||||
c$smtp$current_entity$md5 = md5_hash_finish(c$id);
|
||||
|
||||
NOTICE([$note=MD5, $msg=fmt("Calculated a hash for a MIME entity from %s", c$id$orig_h),
|
||||
$sub=c$smtp$current_entity$md5, $conn=c]);
|
||||
}
|
||||
}
|
||||
|
||||
event mime_one_header(c: connection, h: mime_header_rec)
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
if ( h$name == "CONTENT-DISPOSITION" &&
|
||||
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value )
|
||||
c$smtp$current_entity$filename = extract_filename_from_content_disposition(h$value);
|
||||
}
|
||||
|
||||
event mime_end_entity(c: connection) &priority=-5
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
# This check and the delete below are just to cope with a bug where
|
||||
# mime_end_entity can be generated multiple times for the same event.
|
||||
if ( ! c$smtp?$current_entity )
|
||||
return;
|
||||
|
||||
# Only log is there was some content.
|
||||
if ( c$smtp$current_entity$content_len > 0 )
|
||||
Log::write(SMTP_ENTITIES, c$smtp$current_entity);
|
||||
|
||||
delete c$smtp$current_entity;
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=5
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
if ( extract_file_types in c$smtp$current_entity$mime_type )
|
||||
c$smtp$current_entity$extract_file = T;
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=3
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
if ( c$smtp$current_entity$extract_file &&
|
||||
c$smtp$current_entity$content_len == 0 )
|
||||
{
|
||||
local suffix = fmt("%d.dat", ++c$smtp_state$num_extracted_files);
|
||||
local fname = generate_extraction_filename(extraction_prefix, c, suffix);
|
||||
c$smtp$current_entity$extraction_file = open(fname);
|
||||
enable_raw_output(c$smtp$current_entity$extraction_file);
|
||||
}
|
||||
}
|
||||
|
||||
event mime_segment_data(c: connection, length: count, data: string) &priority=-5
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
if ( c$smtp$current_entity$extract_file && c$smtp$current_entity?$extraction_file )
|
||||
print c$smtp$current_entity$extraction_file, data;
|
||||
}
|
||||
|
||||
event mime_end_entity(c: connection) &priority=-3
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
|
||||
# TODO: this check is only due to a bug in mime_end_entity that
|
||||
# causes the event to be generated twice for the same real event.
|
||||
if ( ! c$smtp?$current_entity )
|
||||
return;
|
||||
|
||||
if ( c$smtp$current_entity?$extraction_file )
|
||||
close(c$smtp$current_entity$extraction_file);
|
||||
}
|
||||
|
|
@ -4,17 +4,14 @@ module SMTP;
|
|||
export {
|
||||
redef enum Log::ID += { SMTP };
|
||||
|
||||
redef enum Notice::Type += {
|
||||
## Indicates that the server sent a reply mentioning an SMTP block list.
|
||||
BL_Error_Message,
|
||||
## Indicates the client's address is seen in the block list error message.
|
||||
BL_Blocked_Host,
|
||||
};
|
||||
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
uid: string &log;
|
||||
id: conn_id &log;
|
||||
## This is an internally generated "message id" that can be used to
|
||||
## map between SMTP messages and MIME entities in the SMTP entities
|
||||
## log.
|
||||
mid: string &log;
|
||||
helo: string &log &optional;
|
||||
mailfrom: string &log &optional;
|
||||
rcptto: set[string] &log &optional;
|
||||
|
|
@ -30,19 +27,13 @@ export {
|
|||
second_received: string &log &optional;
|
||||
## The last message the server sent to the client.
|
||||
last_reply: string &log &optional;
|
||||
files: set[string] &log &optional;
|
||||
path: vector of addr &log &optional;
|
||||
user_agent: string &log &optional;
|
||||
|
||||
## Indicate if this session is currently transmitting SMTP message
|
||||
## envelope headers.
|
||||
in_headers: bool &default=F;
|
||||
## Indicate if the "Received: from" headers should still be processed.
|
||||
process_received_from: bool &default=T;
|
||||
## Maintain the current header for cases where there is header wrapping.
|
||||
current_header: string &default="";
|
||||
## Indicate when the message is logged and no longer applicable.
|
||||
done: bool &default=F;
|
||||
## Indicates if client activity has been seen, but not yet logged
|
||||
has_client_activity: bool &default=F;
|
||||
};
|
||||
|
||||
type State: record {
|
||||
|
|
@ -61,26 +52,7 @@ export {
|
|||
## ALL_HOSTS - always capture the entire path.
|
||||
## NO_HOSTS - never capture the path.
|
||||
const mail_path_capture = ALL_HOSTS &redef;
|
||||
|
||||
# This matches content in SMTP error messages that indicate some
|
||||
# block list doesn't like the connection/mail.
|
||||
const bl_error_messages =
|
||||
/spamhaus\.org\//
|
||||
| /sophos\.com\/security\//
|
||||
| /spamcop\.net\/bl/
|
||||
| /cbl\.abuseat\.org\//
|
||||
| /sorbs\.net\//
|
||||
| /bsn\.borderware\.com\//
|
||||
| /mail-abuse\.com\//
|
||||
| /b\.barracudacentral\.com\//
|
||||
| /psbl\.surriel\.com\//
|
||||
| /antispam\.imp\.ch\//
|
||||
| /dyndns\.com\/.*spam/
|
||||
| /rbl\.knology\.net\//
|
||||
| /intercept\.datapacket\.net\//
|
||||
| /uceprotect\.net\//
|
||||
| /hostkarma\.junkemailfilter\.com\// &redef;
|
||||
|
||||
|
||||
global log_smtp: event(rec: Info);
|
||||
|
||||
## Configure the default ports for SMTP analysis.
|
||||
|
|
@ -121,6 +93,7 @@ function new_smtp_log(c: connection): Info
|
|||
l$ts=network_time();
|
||||
l$uid=c$uid;
|
||||
l$id=c$id;
|
||||
l$mid=unique_id("@");
|
||||
if ( c?$smtp_state && c$smtp_state?$helo )
|
||||
l$helo = c$smtp_state$helo;
|
||||
|
||||
|
|
@ -136,26 +109,23 @@ function set_smtp_session(c: connection)
|
|||
if ( ! c?$smtp_state )
|
||||
c$smtp_state = [];
|
||||
|
||||
if ( ! c?$smtp || c$smtp$done )
|
||||
{
|
||||
if ( ! c?$smtp )
|
||||
c$smtp = new_smtp_log(c);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function smtp_message(c: connection)
|
||||
{
|
||||
Log::write(SMTP, c$smtp);
|
||||
|
||||
c$smtp$done = T;
|
||||
# Track the number of messages seen in this session.
|
||||
++c$smtp_state$messages_transferred;
|
||||
if ( c$smtp$has_client_activity )
|
||||
Log::write(SMTP, c$smtp);
|
||||
}
|
||||
|
||||
event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &priority=5
|
||||
{
|
||||
set_smtp_session(c);
|
||||
local upper_command = to_upper(command);
|
||||
|
||||
if ( upper_command != "QUIT" )
|
||||
c$smtp$has_client_activity = T;
|
||||
|
||||
if ( upper_command == "HELO" || upper_command == "EHLO" )
|
||||
{
|
||||
|
|
@ -172,26 +142,11 @@ event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &
|
|||
|
||||
else if ( upper_command == "MAIL" && /^[fF][rR][oO][mM]:/ in arg )
|
||||
{
|
||||
# In case this is not the first message in a session we want to
|
||||
# essentially write out a log, clear the session tracking, and begin
|
||||
# new session tracking.
|
||||
if ( c$smtp_state$messages_transferred > 0 )
|
||||
{
|
||||
smtp_message(c);
|
||||
set_smtp_session(c);
|
||||
}
|
||||
|
||||
local partially_done = split1(arg, /:[[:blank:]]*/)[2];
|
||||
c$smtp$mailfrom = split1(partially_done, /[[:blank:]]?/)[1];
|
||||
}
|
||||
|
||||
else if ( upper_command == "DATA" )
|
||||
{
|
||||
c$smtp$in_headers = T;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
||||
msg: string, cont_resp: bool) &priority=5
|
||||
{
|
||||
|
|
@ -199,169 +154,98 @@ event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
|||
|
||||
# This continually overwrites, but we want the last reply,
|
||||
# so this actually works fine.
|
||||
if ( code != 421 && code >= 400 )
|
||||
c$smtp$last_reply = fmt("%d %s", code, msg);
|
||||
}
|
||||
|
||||
event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
||||
msg: string, cont_resp: bool) &priority=-5
|
||||
{
|
||||
set_smtp_session(c);
|
||||
if ( cmd == "." )
|
||||
{
|
||||
c$smtp$last_reply = fmt("%d %s", code, msg);
|
||||
|
||||
# Raise a notice when an SMTP error about a block list is discovered.
|
||||
if ( bl_error_messages in msg )
|
||||
{
|
||||
local note = BL_Error_Message;
|
||||
local message = fmt("%s received an error message mentioning an SMTP block list", c$id$orig_h);
|
||||
|
||||
# Determine if the originator's IP address is in the message.
|
||||
local ips = find_ip_addresses(msg);
|
||||
local text_ip = "";
|
||||
if ( |ips| > 0 && to_addr(ips[0]) == c$id$orig_h )
|
||||
{
|
||||
note = BL_Blocked_Host;
|
||||
message = fmt("%s is on an SMTP block list", c$id$orig_h);
|
||||
}
|
||||
|
||||
NOTICE([$note=note, $conn=c, $msg=message, $sub=msg]);
|
||||
}
|
||||
# Track the number of messages seen in this session.
|
||||
++c$smtp_state$messages_transferred;
|
||||
smtp_message(c);
|
||||
c$smtp = new_smtp_log(c);
|
||||
}
|
||||
}
|
||||
|
||||
event smtp_data(c: connection, is_orig: bool, data: string) &priority=5
|
||||
event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
||||
{
|
||||
# Is there something we should be handling from the server?
|
||||
if ( ! is_orig ) return;
|
||||
|
||||
set_smtp_session(c);
|
||||
|
||||
if ( ! c$smtp$in_headers )
|
||||
{
|
||||
if ( /^[cC][oO][nN][tT][eE][nN][tT]-[dD][iI][sS].*[fF][iI][lL][eE][nN][aA][mM][eE]/ in data )
|
||||
{
|
||||
if ( ! c$smtp?$files )
|
||||
c$smtp$files = set();
|
||||
data = sub(data, /^.*[fF][iI][lL][eE][nN][aA][mM][eE]=/, "");
|
||||
add c$smtp$files[data];
|
||||
}
|
||||
return;
|
||||
}
|
||||
if ( ! c?$smtp ) return;
|
||||
c$smtp$has_client_activity = T;
|
||||
|
||||
if ( /^[[:blank:]]*$/ in data )
|
||||
c$smtp$in_headers = F;
|
||||
if ( h$name == "MESSAGE-ID" )
|
||||
c$smtp$msg_id = h$value;
|
||||
|
||||
# This is to reconstruct headers that tend to wrap around.
|
||||
if ( /^[[:blank:]]/ in data )
|
||||
{
|
||||
# Remove all but a single space at the beginning (this seems to follow
|
||||
# the most common behavior).
|
||||
data = sub(data, /^[[:blank:]]*/, " ");
|
||||
if ( c$smtp$current_header == "MESSAGE-ID" )
|
||||
c$smtp$msg_id += data;
|
||||
else if ( c$smtp$current_header == "RECEIVED" )
|
||||
c$smtp$first_received += data;
|
||||
else if ( c$smtp$current_header == "IN-REPLY-TO" )
|
||||
c$smtp$in_reply_to += data;
|
||||
else if ( c$smtp$current_header == "SUBJECCT" )
|
||||
c$smtp$subject += data;
|
||||
else if ( c$smtp$current_header == "FROM" )
|
||||
c$smtp$from += data;
|
||||
else if ( c$smtp$current_header == "REPLY-TO" )
|
||||
c$smtp$reply_to += data;
|
||||
else if ( c$smtp$current_header == "USER-AGENT" )
|
||||
c$smtp$user_agent += data;
|
||||
return;
|
||||
}
|
||||
# Once there isn't a line starting with a blank, we're not continuing a
|
||||
# header anymore.
|
||||
c$smtp$current_header = "";
|
||||
|
||||
local header_parts = split1(data, /:[[:blank:]]*/);
|
||||
# TODO: do something in this case? This would definitely be odd.
|
||||
# Header wrapping needs to be handled more elegantly. This will happen
|
||||
# if the header value is wrapped immediately after the header key.
|
||||
if ( |header_parts| != 2 )
|
||||
return;
|
||||
|
||||
local header_key = to_upper(header_parts[1]);
|
||||
c$smtp$current_header = header_key;
|
||||
|
||||
local header_val = header_parts[2];
|
||||
|
||||
if ( header_key == "MESSAGE-ID" )
|
||||
c$smtp$msg_id = header_val;
|
||||
|
||||
else if ( header_key == "RECEIVED" )
|
||||
else if ( h$name == "RECEIVED" )
|
||||
{
|
||||
if ( c$smtp?$first_received )
|
||||
c$smtp$second_received = c$smtp$first_received;
|
||||
c$smtp$first_received = header_val;
|
||||
c$smtp$first_received = h$value;
|
||||
}
|
||||
|
||||
else if ( header_key == "IN-REPLY-TO" )
|
||||
c$smtp$in_reply_to = header_val;
|
||||
|
||||
else if ( header_key == "DATE" )
|
||||
c$smtp$date = header_val;
|
||||
|
||||
else if ( header_key == "FROM" )
|
||||
c$smtp$from = header_val;
|
||||
|
||||
else if ( header_key == "TO" )
|
||||
|
||||
else if ( h$name == "IN-REPLY-TO" )
|
||||
c$smtp$in_reply_to = h$value;
|
||||
|
||||
else if ( h$name == "SUBJECT" )
|
||||
c$smtp$subject = h$value;
|
||||
|
||||
else if ( h$name == "FROM" )
|
||||
c$smtp$from = h$value;
|
||||
|
||||
else if ( h$name == "REPLY-TO" )
|
||||
c$smtp$reply_to = h$value;
|
||||
|
||||
else if ( h$name == "DATE" )
|
||||
c$smtp$date = h$value;
|
||||
|
||||
else if ( h$name == "TO" )
|
||||
{
|
||||
if ( ! c$smtp?$to )
|
||||
c$smtp$to = set();
|
||||
add c$smtp$to[header_val];
|
||||
add c$smtp$to[h$value];
|
||||
}
|
||||
|
||||
else if ( header_key == "REPLY-TO" )
|
||||
c$smtp$reply_to = header_val;
|
||||
|
||||
else if ( header_key == "SUBJECT" )
|
||||
c$smtp$subject = header_val;
|
||||
|
||||
else if ( header_key == "X-ORIGINATING-IP" )
|
||||
else if ( h$name == "X-ORIGINATING-IP" )
|
||||
{
|
||||
local addresses = find_ip_addresses(header_val);
|
||||
local addresses = find_ip_addresses(h$value);
|
||||
if ( 1 in addresses )
|
||||
c$smtp$x_originating_ip = to_addr(addresses[1]);
|
||||
}
|
||||
|
||||
else if ( header_key == "X-MAILER" ||
|
||||
header_key == "USER-AGENT" ||
|
||||
header_key == "X-USER-AGENT" )
|
||||
{
|
||||
c$smtp$user_agent = header_val;
|
||||
# Explicitly set the current header here because there are several
|
||||
# headers bulked under this same key.
|
||||
c$smtp$current_header = "USER-AGENT";
|
||||
}
|
||||
else if ( h$name == "X-MAILER" ||
|
||||
h$name == "USER-AGENT" ||
|
||||
h$name == "X-USER-AGENT" )
|
||||
c$smtp$user_agent = h$value;
|
||||
}
|
||||
|
||||
# This event handler builds the "Received From" path by reading the
|
||||
# headers in the mail
|
||||
event smtp_data(c: connection, is_orig: bool, data: string) &priority=3
|
||||
event mime_one_header(c: connection, h: mime_header_rec) &priority=3
|
||||
{
|
||||
# If we've decided that we're done watching the received headers for
|
||||
# whatever reason, we're done. Could be due to only watching until
|
||||
# local addresses are seen in the received from headers.
|
||||
if ( c$smtp$current_header != "RECEIVED" ||
|
||||
! c$smtp$process_received_from )
|
||||
if ( ! c?$smtp || h$name != "RECEIVED" || ! c$smtp$process_received_from )
|
||||
return;
|
||||
|
||||
local text_ip = find_address_in_smtp_header(data);
|
||||
|
||||
local text_ip = find_address_in_smtp_header(h$value);
|
||||
if ( text_ip == "" )
|
||||
return;
|
||||
local ip = to_addr(text_ip);
|
||||
|
||||
|
||||
if ( ! addr_matches_host(ip, mail_path_capture) &&
|
||||
! Site::is_private_addr(ip) )
|
||||
{
|
||||
c$smtp$process_received_from = F;
|
||||
}
|
||||
|
||||
if ( c$smtp$path[|c$smtp$path|-1] != ip )
|
||||
c$smtp$path[|c$smtp$path|] = ip;
|
||||
}
|
||||
|
||||
|
||||
event connection_state_remove(c: connection) &priority=-5
|
||||
{
|
||||
if ( c?$smtp && ! c$smtp$done )
|
||||
if ( c?$smtp )
|
||||
smtp_message(c);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,74 +1,58 @@
|
|||
##! Base SSH analysis script. The heuristic to blindly determine success or
|
||||
##! failure for SSH connections is implemented here. At this time, it only
|
||||
##! uses the size of the data being returned from the server to make the
|
||||
##! heuristic determination about success of the connection.
|
||||
##! Requires that :bro:id:`use_conn_size_analyzer` is set to T! The heuristic
|
||||
##! is not attempted if the connection size analyzer isn't enabled.
|
||||
|
||||
module SSH;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { SSH };
|
||||
|
||||
redef enum Notice::Type += {
|
||||
Login,
|
||||
Password_Guessing,
|
||||
Login_By_Password_Guesser,
|
||||
Login_From_Interesting_Hostname,
|
||||
Bytecount_Inconsistency,
|
||||
};
|
||||
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
uid: string &log;
|
||||
id: conn_id &log;
|
||||
## Indicates if the login was heuristically guessed to be "success"
|
||||
## or "failure".
|
||||
status: string &log &optional;
|
||||
direction: string &log &optional;
|
||||
remote_location: geo_location &log &optional;
|
||||
## Direction of the connection. If the client was a local host
|
||||
## logging into an external host, this would be OUTBOUD. INBOUND
|
||||
## would be set for the opposite situation.
|
||||
# TODO: handle local-local and remote-remote better.
|
||||
direction: Direction &log &optional;
|
||||
## The software string given by the client.
|
||||
client: string &log &optional;
|
||||
## The software string given by the server.
|
||||
server: string &log &optional;
|
||||
## The amount of data returned from the server. This is currently
|
||||
## the only measure of the success heuristic and it is logged to
|
||||
## assist analysts looking at the logs to make their own determination
|
||||
## about the success on a case-by-case basis.
|
||||
resp_size: count &log &default=0;
|
||||
|
||||
## Indicate if the SSH session is done being watched.
|
||||
done: bool &default=F;
|
||||
};
|
||||
|
||||
const password_guesses_limit = 30 &redef;
|
||||
|
||||
# The size in bytes at which the SSH connection is presumed to be
|
||||
# successful.
|
||||
## The size in bytes at which the SSH connection is presumed to be
|
||||
## successful.
|
||||
const authentication_data_size = 5500 &redef;
|
||||
|
||||
# The amount of time to remember presumed non-successful logins to build
|
||||
# model of a password guesser.
|
||||
const guessing_timeout = 30 mins &redef;
|
||||
|
||||
# The set of countries for which you'd like to throw notices upon successful login
|
||||
# requires Bro compiled with libGeoIP support
|
||||
const watched_countries: set[string] = {"RO"} &redef;
|
||||
|
||||
# Strange/bad host names to originate successful SSH logins
|
||||
const interesting_hostnames =
|
||||
/^d?ns[0-9]*\./ |
|
||||
/^smtp[0-9]*\./ |
|
||||
/^mail[0-9]*\./ |
|
||||
/^pop[0-9]*\./ |
|
||||
/^imap[0-9]*\./ |
|
||||
/^www[0-9]*\./ |
|
||||
/^ftp[0-9]*\./ &redef;
|
||||
|
||||
# This is a table with orig subnet as the key, and subnet as the value.
|
||||
const ignore_guessers: table[subnet] of subnet &redef;
|
||||
|
||||
# If true, we tell the event engine to not look at further data
|
||||
# packets after the initial SSH handshake. Helps with performance
|
||||
# (especially with large file transfers) but precludes some
|
||||
# kinds of analyses (e.g., tracking connection size).
|
||||
## If true, we tell the event engine to not look at further data
|
||||
## packets after the initial SSH handshake. Helps with performance
|
||||
## (especially with large file transfers) but precludes some
|
||||
## kinds of analyses (e.g., tracking connection size).
|
||||
const skip_processing_after_detection = F &redef;
|
||||
|
||||
# Keeps count of how many rejections a host has had
|
||||
global password_rejections: table[addr] of TrackCount
|
||||
&write_expire=guessing_timeout
|
||||
&synchronized;
|
||||
|
||||
# Keeps track of hosts identified as guessing passwords
|
||||
# TODO: guessing_timeout doesn't work correctly here. If a user redefs
|
||||
# the variable, it won't take effect.
|
||||
global password_guessers: set[addr] &read_expire=guessing_timeout+1hr &synchronized;
|
||||
## This event is generated when the heuristic thinks that a login
|
||||
## was successful.
|
||||
global heuristic_successful_login: event(c: connection);
|
||||
|
||||
## This event is generated when the heuristic thinks that a login
|
||||
## failed.
|
||||
global heuristic_failed_login: event(c: connection);
|
||||
|
||||
global log_ssh: event(rec: Info);
|
||||
}
|
||||
|
|
@ -106,116 +90,51 @@ function check_ssh_connection(c: connection, done: bool)
|
|||
|
||||
# If this is still a live connection and the byte count has not
|
||||
# crossed the threshold, just return and let the resheduled check happen later.
|
||||
if ( !done && c$resp$size < authentication_data_size )
|
||||
if ( !done && c$resp$num_bytes_ip < authentication_data_size )
|
||||
return;
|
||||
|
||||
# Make sure the server has sent back more than 50 bytes to filter out
|
||||
# hosts that are just port scanning. Nothing is ever logged if the server
|
||||
# doesn't send back at least 50 bytes.
|
||||
if ( c$resp$size < 50 )
|
||||
if ( c$resp$num_bytes_ip < 50 )
|
||||
return;
|
||||
|
||||
local status = "failure";
|
||||
local direction = Site::is_local_addr(c$id$orig_h) ? "to" : "from";
|
||||
local location: geo_location;
|
||||
location = (direction == "to") ? lookup_location(c$id$resp_h) : lookup_location(c$id$orig_h);
|
||||
c$ssh$direction = Site::is_local_addr(c$id$orig_h) ? OUTBOUND : INBOUND;
|
||||
c$ssh$resp_size = c$resp$num_bytes_ip;
|
||||
|
||||
if ( done && c$resp$size < authentication_data_size )
|
||||
if ( c$resp$num_bytes_ip < authentication_data_size )
|
||||
{
|
||||
# presumed failure
|
||||
if ( c$id$orig_h !in password_rejections )
|
||||
password_rejections[c$id$orig_h] = new_track_count();
|
||||
|
||||
# Track the number of rejections
|
||||
if ( !(c$id$orig_h in ignore_guessers &&
|
||||
c$id$resp_h in ignore_guessers[c$id$orig_h]) )
|
||||
++password_rejections[c$id$orig_h]$n;
|
||||
|
||||
if ( default_check_threshold(password_rejections[c$id$orig_h]) )
|
||||
{
|
||||
add password_guessers[c$id$orig_h];
|
||||
NOTICE([$note=Password_Guessing,
|
||||
$conn=c,
|
||||
$msg=fmt("SSH password guessing by %s", c$id$orig_h),
|
||||
$sub=fmt("%d failed logins", password_rejections[c$id$orig_h]$n),
|
||||
$n=password_rejections[c$id$orig_h]$n]);
|
||||
}
|
||||
}
|
||||
# TODO: This is to work around a quasi-bug in Bro which occasionally
|
||||
# causes the byte count to be oversized.
|
||||
# Watch for Gregors work that adds an actual counter of bytes transferred.
|
||||
else if ( c$resp$size < 20000000 )
|
||||
c$ssh$status = "failure";
|
||||
event SSH::heuristic_failed_login(c);
|
||||
}
|
||||
else
|
||||
{
|
||||
# presumed successful login
|
||||
status = "success";
|
||||
c$ssh$done = T;
|
||||
|
||||
if ( c$id$orig_h in password_rejections &&
|
||||
password_rejections[c$id$orig_h]$n > password_guesses_limit &&
|
||||
c$id$orig_h !in password_guessers )
|
||||
{
|
||||
add password_guessers[c$id$orig_h];
|
||||
NOTICE([$note=Login_By_Password_Guesser,
|
||||
$conn=c,
|
||||
$n=password_rejections[c$id$orig_h]$n,
|
||||
$msg=fmt("Successful SSH login by password guesser %s", c$id$orig_h),
|
||||
$sub=fmt("%d failed logins", password_rejections[c$id$orig_h]$n)]);
|
||||
}
|
||||
|
||||
local message = fmt("SSH login %s %s \"%s\" \"%s\" %f %f %s (triggered with %d bytes)",
|
||||
direction, location$country_code, location$region, location$city,
|
||||
location$latitude, location$longitude,
|
||||
id_string(c$id), c$resp$size);
|
||||
NOTICE([$note=Login,
|
||||
$conn=c,
|
||||
$msg=message,
|
||||
$sub=location$country_code]);
|
||||
|
||||
# Check to see if this login came from an interesting hostname
|
||||
when ( local hostname = lookup_addr(c$id$orig_h) )
|
||||
{
|
||||
if ( interesting_hostnames in hostname )
|
||||
{
|
||||
NOTICE([$note=Login_From_Interesting_Hostname,
|
||||
$conn=c,
|
||||
$msg=fmt("Strange login from %s", hostname),
|
||||
$sub=hostname]);
|
||||
}
|
||||
}
|
||||
|
||||
if ( location$country_code in watched_countries )
|
||||
{
|
||||
|
||||
}
|
||||
|
||||
c$ssh$status = "success";
|
||||
event SSH::heuristic_successful_login(c);
|
||||
}
|
||||
else if ( c$resp$size >= 200000000 )
|
||||
{
|
||||
NOTICE([$note=Bytecount_Inconsistency,
|
||||
$conn=c,
|
||||
$msg="During byte counting in SSH analysis, an overly large value was seen.",
|
||||
$sub=fmt("%d",c$resp$size)]);
|
||||
}
|
||||
|
||||
c$ssh$remote_location = location;
|
||||
c$ssh$status = status;
|
||||
c$ssh$direction = direction;
|
||||
c$ssh$resp_size = c$resp$size;
|
||||
|
||||
Log::write(SSH, c$ssh);
|
||||
|
||||
# Set the "done" flag to prevent the watching event from rescheduling
|
||||
# after detection is done.
|
||||
c$ssh$done;
|
||||
c$ssh$done=T;
|
||||
|
||||
# Stop watching this connection, we don't care about it anymore.
|
||||
if ( skip_processing_after_detection )
|
||||
{
|
||||
# Stop watching this connection, we don't care about it anymore.
|
||||
skip_further_processing(c$id);
|
||||
set_record_packets(c$id, F);
|
||||
}
|
||||
}
|
||||
|
||||
event SSH::heuristic_successful_login(c: connection) &priority=-5
|
||||
{
|
||||
Log::write(SSH, c$ssh);
|
||||
}
|
||||
event SSH::heuristic_failed_login(c: connection) &priority=-5
|
||||
{
|
||||
Log::write(SSH, c$ssh);
|
||||
}
|
||||
|
||||
event connection_state_remove(c: connection) &priority=-5
|
||||
{
|
||||
if ( c?$ssh )
|
||||
|
|
@ -226,7 +145,7 @@ event ssh_watcher(c: connection)
|
|||
{
|
||||
local id = c$id;
|
||||
# don't go any further if this connection is gone already!
|
||||
if ( !connection_exists(id) )
|
||||
if ( ! connection_exists(id) )
|
||||
return;
|
||||
|
||||
check_ssh_connection(c, F);
|
||||
|
|
@ -244,5 +163,9 @@ event ssh_client_version(c: connection, version: string) &priority=5
|
|||
{
|
||||
set_session(c);
|
||||
c$ssh$client = version;
|
||||
schedule +15secs { ssh_watcher(c) };
|
||||
|
||||
# The heuristic detection for SSH relies on the ConnSize analyzer.
|
||||
# Don't do the heuristics if it's disabled.
|
||||
if ( use_conn_size_analyzer )
|
||||
schedule +15secs { ssh_watcher(c) };
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,4 +12,15 @@ function generate_extraction_filename(prefix: string, c: connection, suffix: str
|
|||
conn_info = fmt("%s_%s", conn_info, suffix);
|
||||
|
||||
return conn_info;
|
||||
}
|
||||
}
|
||||
|
||||
## For CONTENT-DISPOSITION headers, this function can be used to extract
|
||||
## the filename.
|
||||
function extract_filename_from_content_disposition(data: string): string
|
||||
{
|
||||
local filename = sub(data, /^.*[fF][iI][lL][eE][nN][aA][mM][eE]=/, "");
|
||||
# Remove quotes around the filename if they are there.
|
||||
if ( /^\"/ in filename )
|
||||
filename = split_n(filename, /\"/, F, 2)[2];
|
||||
return filename;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -16,6 +16,10 @@ export {
|
|||
|
||||
## Networks that are considered "local".
|
||||
const local_nets: set[subnet] &redef;
|
||||
|
||||
## This is used for mapping between local networks and string
|
||||
## values for the CIDRs represented.
|
||||
global local_nets_table: table[subnet] of string = {};
|
||||
|
||||
## Networks that are considered "neighbors".
|
||||
const neighbor_nets: set[subnet] &redef;
|
||||
|
|
@ -138,4 +142,9 @@ event bro_init() &priority=10
|
|||
# Double backslashes are needed due to string parsing.
|
||||
local_dns_suffix_regex = set_to_regex(local_zones, "(^\\.?|\\.)(~~)$");
|
||||
local_dns_neighbor_suffix_regex = set_to_regex(neighbor_zones, "(^\\.?|\\.)(~~)$");
|
||||
|
||||
# Create the local_nets mapping table.
|
||||
for ( cidr in Site::local_nets )
|
||||
local_nets_table[cidr] = fmt("%s", cidr);
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,5 +15,6 @@ export {
|
|||
|
||||
event bro_init() &priority=-10
|
||||
{
|
||||
enable_communication();
|
||||
listen(listen_if_clear, listen_port_clear, F);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -16,5 +16,6 @@ export {
|
|||
|
||||
event bro_init() &priority=-10
|
||||
{
|
||||
enable_communication();
|
||||
listen(listen_if_ssl, listen_port_ssl, T);
|
||||
}
|
||||
|
|
|
|||
20
scripts/policy/frameworks/metrics/conn-example.bro
Normal file
20
scripts/policy/frameworks/metrics/conn-example.bro
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
|
||||
redef enum Metrics::ID += {
|
||||
CONNS_ORIGINATED,
|
||||
CONNS_RESPONDED
|
||||
};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Metrics::add_filter(CONNS_ORIGINATED, [$aggregation_mask=24, $break_interval=1mins]);
|
||||
|
||||
# Site::local_nets must be defined in order for this to actually do anything.
|
||||
Metrics::add_filter(CONNS_RESPONDED, [$aggregation_table=Site::local_nets_table, $break_interval=1mins]);
|
||||
}
|
||||
|
||||
event connection_established(c: connection)
|
||||
{
|
||||
Metrics::add_data(CONNS_ORIGINATED, [$host=c$id$orig_h]);
|
||||
Metrics::add_data(CONNS_RESPONDED, [$host=c$id$resp_h]);
|
||||
}
|
||||
|
||||
22
scripts/policy/frameworks/metrics/http-example.bro
Normal file
22
scripts/policy/frameworks/metrics/http-example.bro
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
HTTP_REQUESTS_BY_STATUS_CODE,
|
||||
HTTP_REQUESTS_BY_HOST_HEADER,
|
||||
};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Metrics::add_filter(HTTP_REQUESTS_BY_HOST_HEADER, [$break_interval=5mins]);
|
||||
|
||||
# Site::local_nets must be defined in order for this to actually do anything.
|
||||
Metrics::add_filter(HTTP_REQUESTS_BY_STATUS_CODE, [$aggregation_table=Site::local_nets_table, $break_interval=5mins]);
|
||||
}
|
||||
|
||||
event HTTP::log_http(rec: HTTP::Info)
|
||||
{
|
||||
if ( rec?$host )
|
||||
Metrics::add_data(HTTP_REQUESTS_BY_HOST_HEADER, [$index=rec$host]);
|
||||
if ( rec?$status_code )
|
||||
Metrics::add_data(HTTP_REQUESTS_BY_STATUS_CODE, [$host=rec$id$orig_h, $index=fmt("%d", rec$status_code)]);
|
||||
}
|
||||
22
scripts/policy/frameworks/metrics/ssl-example.bro
Normal file
22
scripts/policy/frameworks/metrics/ssl-example.bro
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
SSL_SERVERNAME,
|
||||
};
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Metrics::add_filter(SSL_SERVERNAME,
|
||||
[$name="no-google-ssl-servers",
|
||||
$pred(entry: Metrics::Entry) = {
|
||||
return (/google\.com$/ !in entry$index);
|
||||
},
|
||||
$break_interval=10secs
|
||||
]);
|
||||
}
|
||||
|
||||
event SSL::log_ssl(rec: SSL::Info)
|
||||
{
|
||||
if ( rec?$server_name )
|
||||
Metrics::add_data(SSL_SERVERNAME, [$index=rec$server_name]);
|
||||
}
|
||||
19
scripts/policy/misc/profiling.bro
Normal file
19
scripts/policy/misc/profiling.bro
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
##! Turns on profiling of Bro resource consumption.
|
||||
|
||||
module Profiling;
|
||||
|
||||
redef profiling_file = open_log_file("prof");
|
||||
|
||||
export {
|
||||
## Cheap profiling every 15 seconds.
|
||||
redef profiling_interval = 15 secs &redef;
|
||||
}
|
||||
|
||||
# Expensive profiling every 5 minutes.
|
||||
redef expensive_profiling_multiple = 20;
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
set_buf(profiling_file, F);
|
||||
}
|
||||
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
##! This script takes MD5 sums of files transferred over HTTP and checks them with
|
||||
##! Team Cymru's Malware Hash Registry (http://www.team-cymru.org/Services/MHR/).
|
||||
##! By default, not all file transfers will have MD5 sums calculated. Read the
|
||||
##! documentation for the protocols/http/file-hash.bro script to see how to
|
||||
##! documentation for the base/protocols/http/file-hash.bro script to see how to
|
||||
##! configure which transfers will have hashes calculated.
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -9,17 +9,17 @@ export {
|
|||
};
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
SQL_ATTACKER,
|
||||
SQL_ATTACK_AGAINST,
|
||||
SQL_ATTACKS,
|
||||
SQL_ATTACKS_AGAINST,
|
||||
};
|
||||
|
||||
redef enum Tags += {
|
||||
## Indicator of a URI based SQL injection attack.
|
||||
URI_SQLI,
|
||||
## Indicator of client body based SQL injection attack. This is
|
||||
## typically the body content of a POST request. Not implemented yet!
|
||||
## typically the body content of a POST request. Not implemented yet.
|
||||
POST_SQLI,
|
||||
## Indicator of a cookie based SQL injection attack. Not implemented yet!
|
||||
## Indicator of a cookie based SQL injection attack. Not implemented yet.
|
||||
COOKIE_SQLI,
|
||||
};
|
||||
|
||||
|
|
@ -30,13 +30,18 @@ export {
|
|||
| /[\?&][^[:blank:]\x00-\x37]+?=[\-0-9%]*([[:blank:]\x00-\x37]|\/\*.*?\*\/)*['"]([[:blank:]\x00-\x37]|\/\*.*?\*\/)*(-|=|\+|\|\|)([[:blank:]\x00-\x37]|\/\*.*?\*\/)*([0-9]|\(?[cC][oO][nN][vV][eE][rR][tT]|[cC][aA][sS][tT])/
|
||||
| /[\?&][^[:blank:]\x00-\x37\|]+?=([[:blank:]\x00-\x37]|\/\*.*?\*\/)*['"]([[:blank:]\x00-\x37]|\/\*.*?\*\/|;)*([xX]?[oO][rR]|[nN]?[aA][nN][dD]|[hH][aA][vV][iI][nN][gG]|[uU][nN][iI][oO][nN]|[eE][xX][eE][cC]|[sS][eE][lL][eE][cC][tT]|[dD][eE][lL][eE][tT][eE]|[dD][rR][oO][pP]|[dD][eE][cC][lL][aA][rR][eE]|[cC][rR][eE][aA][tT][eE]|[rR][eE][gG][eE][xX][pP]|[iI][nN][sS][eE][rR][tT])([[:blank:]\x00-\x37]|\/\*.*?\*\/|[\[(])+[a-zA-Z&]{2,}/
|
||||
| /[\?&][^[:blank:]\x00-\x37]+?=[^\.]*?([cC][hH][aA][rR]|[aA][sS][cC][iI][iI]|[sS][uU][bB][sS][tT][rR][iI][nN][gG]|[tT][rR][uU][nN][cC][aA][tT][eE]|[vV][eE][rR][sS][iI][oO][nN]|[lL][eE][nN][gG][tT][hH])\(/
|
||||
| /\/\*![[:digit:]]{5}.*?\*\//;
|
||||
| /\/\*![[:digit:]]{5}.*?\*\// &redef;
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Metrics::add_filter(SQL_ATTACKER, [$break_interval=5mins, $note=SQL_Injection_Attack]);
|
||||
Metrics::add_filter(SQL_ATTACK_AGAINST, [$break_interval=5mins, $note=SQL_Injection_Attack]);
|
||||
Metrics::add_filter(SQL_ATTACKS, [$log=T,
|
||||
$break_interval=1mins,
|
||||
$note=SQL_Injection_Attacker]);
|
||||
Metrics::add_filter(SQL_ATTACKS_AGAINST, [$log=T,
|
||||
$break_interval=1mins,
|
||||
$note=SQL_Injection_Attack,
|
||||
$notice_thresholds=vector(10,100)]);
|
||||
}
|
||||
|
||||
event http_request(c: connection, method: string, original_URI: string,
|
||||
|
|
@ -46,7 +51,7 @@ event http_request(c: connection, method: string, original_URI: string,
|
|||
{
|
||||
add c$http$tags[URI_SQLI];
|
||||
|
||||
Metrics::add_data(SQL_ATTACKER, [$host=c$id$orig_h], 1);
|
||||
Metrics::add_data(SQL_ATTACK_AGAINST, [$host=c$id$resp_h], 1);
|
||||
Metrics::add_data(SQL_ATTACKS, [$host=c$id$orig_h]);
|
||||
Metrics::add_data(SQL_ATTACKS_AGAINST, [$host=c$id$resp_h]);
|
||||
}
|
||||
}
|
||||
58
scripts/policy/protocols/smtp/blocklists.bro
Normal file
58
scripts/policy/protocols/smtp/blocklists.bro
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
|
||||
@load base/protocols/smtp
|
||||
|
||||
module SMTP;
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## Indicates that the server sent a reply mentioning an SMTP block list.
|
||||
Blocklist_Error_Message,
|
||||
## Indicates the client's address is seen in the block list error message.
|
||||
Blocklist_Blocked_Host,
|
||||
};
|
||||
|
||||
# This matches content in SMTP error messages that indicate some
|
||||
# block list doesn't like the connection/mail.
|
||||
const blocklist_error_messages =
|
||||
/spamhaus\.org\//
|
||||
| /sophos\.com\/security\//
|
||||
| /spamcop\.net\/bl/
|
||||
| /cbl\.abuseat\.org\//
|
||||
| /sorbs\.net\//
|
||||
| /bsn\.borderware\.com\//
|
||||
| /mail-abuse\.com\//
|
||||
| /b\.barracudacentral\.com\//
|
||||
| /psbl\.surriel\.com\//
|
||||
| /antispam\.imp\.ch\//
|
||||
| /dyndns\.com\/.*spam/
|
||||
| /rbl\.knology\.net\//
|
||||
| /intercept\.datapacket\.net\//
|
||||
| /uceprotect\.net\//
|
||||
| /hostkarma\.junkemailfilter\.com\// &redef;
|
||||
|
||||
}
|
||||
|
||||
event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
||||
msg: string, cont_resp: bool) &priority=3
|
||||
{
|
||||
if ( code >= 400 && code != 421 )
|
||||
{
|
||||
# Raise a notice when an SMTP error about a block list is discovered.
|
||||
if ( blocklist_error_messages in msg )
|
||||
{
|
||||
local note = Blocklist_Error_Message;
|
||||
local message = fmt("%s received an error message mentioning an SMTP block list", c$id$orig_h);
|
||||
|
||||
# Determine if the originator's IP address is in the message.
|
||||
local ips = find_ip_addresses(msg);
|
||||
local text_ip = "";
|
||||
if ( |ips| > 0 && to_addr(ips[0]) == c$id$orig_h )
|
||||
{
|
||||
note = Blocklist_Blocked_Host;
|
||||
message = fmt("%s is on an SMTP block list", c$id$orig_h);
|
||||
}
|
||||
|
||||
NOTICE([$note=note, $conn=c, $msg=message, $sub=msg]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -43,10 +43,10 @@ export {
|
|||
| /ZimbraWebClient/ &redef;
|
||||
}
|
||||
|
||||
event smtp_data(c: connection, is_orig: bool, data: string) &priority=4
|
||||
event mime_one_header(c: connection, h: mime_header_rec) &priority=4
|
||||
{
|
||||
if ( c$smtp$current_header == "USER-AGENT" &&
|
||||
webmail_user_agents in c$smtp$user_agent )
|
||||
if ( ! c?$smtp ) return;
|
||||
if ( h$name == "USER-AGENT" && webmail_user_agents in c$smtp$user_agent )
|
||||
c$smtp$is_webmail = T;
|
||||
}
|
||||
|
||||
|
|
|
|||
79
scripts/policy/protocols/ssh/detect-bruteforcing.bro
Normal file
79
scripts/policy/protocols/ssh/detect-bruteforcing.bro
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
|
||||
module SSH;
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## Indicates that a host has been identified as crossing the
|
||||
## :bro:id:`password_guesses_limit` threshold with heuristically
|
||||
## determined failed logins.
|
||||
Password_Guessing,
|
||||
## Indicates that a host previously identified as a "password guesser"
|
||||
## has now had a heuristically successful login attempt.
|
||||
Login_By_Password_Guesser,
|
||||
};
|
||||
|
||||
## The number of failed SSH connections before a host is designated as
|
||||
## guessing passwords.
|
||||
const password_guesses_limit = 30 &redef;
|
||||
|
||||
## The amount of time to remember presumed non-successful logins to build
|
||||
## model of a password guesser.
|
||||
const guessing_timeout = 30 mins &redef;
|
||||
|
||||
## This value can be used to exclude hosts or entire networks from being
|
||||
## tracked as potential "guessers". There are cases where the success
|
||||
## heuristic fails and this acts as the whitelist. The index represents
|
||||
## client subnets and the yield value represents server subnets.
|
||||
const ignore_guessers: table[subnet] of subnet &redef;
|
||||
|
||||
## Keeps count of how many rejections a host has had.
|
||||
global password_rejections: table[addr] of TrackCount
|
||||
&write_expire=guessing_timeout
|
||||
&synchronized;
|
||||
|
||||
## Keeps track of hosts identified as guessing passwords.
|
||||
global password_guessers: set[addr] &read_expire=guessing_timeout+1hr &synchronized;
|
||||
}
|
||||
|
||||
event SSH::heuristic_successful_login(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
|
||||
# TODO: this should be migrated to the metrics framework.
|
||||
if ( id$orig_h in password_rejections &&
|
||||
password_rejections[id$orig_h]$n > password_guesses_limit &&
|
||||
id$orig_h !in password_guessers )
|
||||
{
|
||||
add password_guessers[id$orig_h];
|
||||
NOTICE([$note=Login_By_Password_Guesser,
|
||||
$conn=c,
|
||||
$n=password_rejections[id$orig_h]$n,
|
||||
$msg=fmt("Successful SSH login by password guesser %s", id$orig_h),
|
||||
$sub=fmt("%d failed logins", password_rejections[id$orig_h]$n)]);
|
||||
}
|
||||
}
|
||||
|
||||
event SSH::heuristic_failed_login(c: connection)
|
||||
{
|
||||
local id = c$id;
|
||||
|
||||
# presumed failure
|
||||
if ( id$orig_h !in password_rejections )
|
||||
password_rejections[id$orig_h] = new_track_count();
|
||||
|
||||
# Track the number of rejections
|
||||
# TODO: this should be migrated to the metrics framework.
|
||||
if ( ! (id$orig_h in ignore_guessers &&
|
||||
id$resp_h in ignore_guessers[id$orig_h]) )
|
||||
++password_rejections[id$orig_h]$n;
|
||||
|
||||
if ( default_check_threshold(password_rejections[id$orig_h]) )
|
||||
{
|
||||
add password_guessers[id$orig_h];
|
||||
NOTICE([$note=Password_Guessing,
|
||||
$conn=c,
|
||||
$msg=fmt("SSH password guessing by %s", id$orig_h),
|
||||
$sub=fmt("%d apparently failed logins", password_rejections[id$orig_h]$n),
|
||||
$n=password_rejections[id$orig_h]$n]);
|
||||
}
|
||||
}
|
||||
39
scripts/policy/protocols/ssh/geo-data.bro
Normal file
39
scripts/policy/protocols/ssh/geo-data.bro
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
##! This implements all of the additional information and geodata detections
|
||||
##! for SSH analysis.
|
||||
|
||||
module SSH;
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## If an SSH login is seen to or from a "watched" country based on the
|
||||
## :bro:id:`SSH::watched_countries` variable then this notice will
|
||||
## be generated.
|
||||
Login_From_Watched_Country,
|
||||
};
|
||||
|
||||
## The set of countries for which you'd like to throw notices upon
|
||||
## successful login
|
||||
const watched_countries: set[string] = {"RO"} &redef;
|
||||
|
||||
redef record Info += {
|
||||
## Add geographic data related to the "remote" host of the connection.
|
||||
remote_location: geo_location &log &optional;
|
||||
};
|
||||
}
|
||||
|
||||
event SSH::heuristic_successful_login(c: connection) &priority=5
|
||||
{
|
||||
local location: geo_location;
|
||||
location = (c$ssh$direction == OUTBOUND) ?
|
||||
lookup_location(c$id$resp_h) : lookup_location(c$id$orig_h);
|
||||
|
||||
# Add the location data to the SSH record.
|
||||
c$ssh$remote_location = location;
|
||||
|
||||
if ( location$country_code in watched_countries )
|
||||
{
|
||||
NOTICE([$note=Login_From_Watched_Country,
|
||||
$conn=c,
|
||||
$msg=fmt("SSH login from watched country: %s", location$country_code)]);
|
||||
}
|
||||
}
|
||||
50
scripts/policy/protocols/ssh/interesting-hostnames.bro
Normal file
50
scripts/policy/protocols/ssh/interesting-hostnames.bro
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
|
||||
module SSH;
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## Generated if a login originates from a host matched by the
|
||||
## :bro:id:`interesting_hostnames` regular expression.
|
||||
Login_From_Interesting_Hostname,
|
||||
## Generated if a login goes to a host matched by the
|
||||
## :bro:id:`interesting_hostnames` regular expression.
|
||||
Login_To_Interesting_Hostname,
|
||||
};
|
||||
|
||||
## Strange/bad host names to see successful SSH logins from or to.
|
||||
const interesting_hostnames =
|
||||
/^d?ns[0-9]*\./ |
|
||||
/^smtp[0-9]*\./ |
|
||||
/^mail[0-9]*\./ |
|
||||
/^pop[0-9]*\./ |
|
||||
/^imap[0-9]*\./ |
|
||||
/^www[0-9]*\./ |
|
||||
/^ftp[0-9]*\./ &redef;
|
||||
}
|
||||
|
||||
event SSH::heuristic_successful_login(c: connection)
|
||||
{
|
||||
# Check to see if this login came from an interesting hostname.
|
||||
when ( local orig_hostname = lookup_addr(c$id$orig_h) )
|
||||
{
|
||||
if ( interesting_hostnames in orig_hostname )
|
||||
{
|
||||
NOTICE([$note=Login_From_Interesting_Hostname,
|
||||
$conn=c,
|
||||
$msg=fmt("Interesting login from hostname: %s", orig_hostname),
|
||||
$sub=orig_hostname]);
|
||||
}
|
||||
}
|
||||
# Check to see if this login went to an interesting hostname.
|
||||
when ( local resp_hostname = lookup_addr(c$id$orig_h) )
|
||||
{
|
||||
if ( interesting_hostnames in resp_hostname )
|
||||
{
|
||||
NOTICE([$note=Login_To_Interesting_Hostname,
|
||||
$conn=c,
|
||||
$msg=fmt("Interesting login to hostname: %s", resp_hostname),
|
||||
$sub=resp_hostname]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -3,8 +3,8 @@ module SSH;
|
|||
|
||||
export {
|
||||
redef enum Software::Type += {
|
||||
SSH_SERVER,
|
||||
SSH_CLIENT,
|
||||
SERVER,
|
||||
CLIENT,
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -12,7 +12,7 @@ event ssh_client_version(c: connection, version: string) &priority=4
|
|||
{
|
||||
# Get rid of the protocol information when passing to the software framework.
|
||||
local cleaned_version = sub(version, /^SSH[0-9\.\-]+/, "");
|
||||
local si = Software::parse(cleaned_version, c$id$orig_h, SSH_CLIENT);
|
||||
local si = Software::parse(cleaned_version, c$id$orig_h, CLIENT);
|
||||
Software::found(c$id, si);
|
||||
}
|
||||
|
||||
|
|
@ -20,6 +20,6 @@ event ssh_server_version(c: connection, version: string) &priority=4
|
|||
{
|
||||
# Get rid of the protocol information when passing to the software framework.
|
||||
local cleaned_version = sub(version, /SSH[0-9\.\-]{2,}/, "");
|
||||
local si = Software::parse(cleaned_version, c$id$resp_h, SSH_SERVER);
|
||||
local si = Software::parse(cleaned_version, c$id$resp_h, SERVER);
|
||||
Software::found(c$id, si);
|
||||
}
|
||||
|
|
|
|||
7
scripts/site/local-manager.bro
Normal file
7
scripts/site/local-manager.bro
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
##! Local site policy loaded only by the manager in a cluster.
|
||||
|
||||
# If you are running a cluster you should define your Notice::policy here
|
||||
# so that notice processing occurs on the manager.
|
||||
redef Notice::policy += {
|
||||
|
||||
};
|
||||
2
scripts/site/local-proxy.bro
Normal file
2
scripts/site/local-proxy.bro
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
##! Local site policy loaded only by the proxies if Bro is running as a cluster.
|
||||
|
||||
1
scripts/site/local-worker.bro
Normal file
1
scripts/site/local-worker.bro
Normal file
|
|
@ -0,0 +1 @@
|
|||
##! Local site policy loaded only by the workers if Bro is running as a cluster.
|
||||
|
|
@ -22,6 +22,7 @@ redef signature_files += "frameworks/signatures/detect-windows-shells.sig";
|
|||
|
||||
# Load all of the scripts that detect software in various protocols.
|
||||
@load protocols/http/software
|
||||
#@load protocols/http/detect-webapps
|
||||
@load protocols/ftp/software
|
||||
@load protocols/smtp/software
|
||||
@load protocols/ssh/software
|
||||
|
|
@ -44,3 +45,24 @@ redef signature_files += "frameworks/signatures/detect-windows-shells.sig";
|
|||
|
||||
# Load the script to enable SSL/TLS certificate validation.
|
||||
@load protocols/ssl/validate-certs
|
||||
|
||||
# If you have libGeoIP support built in, do some geographic detections and
|
||||
# logging for SSH traffic.
|
||||
@load protocols/ssh/geo-data
|
||||
# Detect hosts doing SSH bruteforce attacks.
|
||||
@load protocols/ssh/detect-bruteforcing
|
||||
# Detect logins using "interesting" hostnames.
|
||||
@load protocols/ssh/interesting-hostnames
|
||||
|
||||
# Detect MD5 sums in Team Cymru's Malware Hash Registry.
|
||||
@load protocols/http/detect-MHR
|
||||
# Detect SQL injection attacks
|
||||
@load protocols/http/detect-sqli
|
||||
|
||||
# Uncomment this redef if you want to extract SMTP MIME entities for
|
||||
# some file types. The numbers given indicate how many bytes to extract for
|
||||
# the various mime types.
|
||||
redef SMTP::entity_excerpt_len += {
|
||||
# ["text/plain"] = 1024,
|
||||
# ["text/html"] = 1024,
|
||||
};
|
||||
|
|
|
|||
|
|
@ -2,18 +2,17 @@
|
|||
#
|
||||
# This is rarely makes sense, and is for testing only.
|
||||
#
|
||||
# Note that we have unit test that makes sure that all policy files shipped are
|
||||
# Note that we have a unit test that makes sure that all policy files shipped are
|
||||
# actually loaded here. If we have files that are part of the distribution yet
|
||||
# can't be loaded here, these must still be listed here with their load command
|
||||
# commented out.
|
||||
|
||||
# The base/ scripts are all loaded by default and not included here.
|
||||
|
||||
# @load test-all.bro
|
||||
# @load frameworks/communication/listen-clear.bro
|
||||
# @load frameworks/communication/listen-ssl.bro
|
||||
# @load frameworks/control/controllee
|
||||
# @load frameworks/control/controller
|
||||
# @load frameworks/control/controllee.bro
|
||||
# @load frameworks/control/controller.bro
|
||||
@load frameworks/dpd/detect-protocols.bro
|
||||
@load frameworks/dpd/packet-segment-logging.bro
|
||||
@load frameworks/software/version-changes.bro
|
||||
|
|
@ -27,6 +26,7 @@
|
|||
@load misc/trim-trace-file.bro
|
||||
@load protocols/conn/known-hosts.bro
|
||||
@load protocols/conn/known-services.bro
|
||||
# @load protocols/conn/scan.bro
|
||||
@load protocols/dns/auth-addl.bro
|
||||
@load protocols/dns/detect-external-names.bro
|
||||
@load protocols/ftp/detect.bro
|
||||
|
|
@ -50,4 +50,4 @@
|
|||
@load tuning/defaults/remove-high-volume-notices.bro
|
||||
@load tuning/defaults/warnings.bro
|
||||
@load tuning/track-all-assets.bro
|
||||
@load site/local
|
||||
# @load hot.conn.bro
|
||||
Loading…
Add table
Add a link
Reference in a new issue