Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Some script level fixes.

Browse source 
- Fixed a type name conflict in the Known namespace.

- Fixed a DPD framework bug that was causing Reporter messages.
This commit is contained in:
Seth Hall 2011-09-25 02:09:50 -04:00
parent 5911520563
commit 43ea0ba182
4 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/frameworks/dpd/main.bro
View file

@ -25,7 +25,7 @@ export {
## Disabled analyzer IDs. This is only for internal tracking ## Disabled analyzer IDs. This is only for internal tracking
## so as to not attempt to disable analyzers multiple times. ## so as to not attempt to disable analyzers multiple times.
disabled_aids: set[count] &default=set(); disabled_aids: set[count];
}; };
## Ignore violations which go this many bytes into the connection. ## Ignore violations which go this many bytes into the connection.

6
scripts/policy/protocols/conn/known-hosts.bro
View file

@ -10,7 +10,7 @@ module Known;
export { export {
redef enum Log::ID += { HOSTS_LOG }; redef enum Log::ID += { HOSTS_LOG };
type Info: record { type HostsInfo: record {
## The timestamp at which the host was detected. ## The timestamp at which the host was detected.
ts: time &log; ts: time &log;
## The address that was detected originating or responding to a TCP ## The address that was detected originating or responding to a TCP
@ -29,12 +29,12 @@ export {
## of each individual address is logged each day. ## of each individual address is logged each day.
global known_hosts: set[addr] &create_expire=1day &synchronized &redef; global known_hosts: set[addr] &create_expire=1day &synchronized &redef;
global log_known_hosts: event(rec: Info); global log_known_hosts: event(rec: HostsInfo);
} }
event bro_init() event bro_init()
{ {
Log::create_stream(Known::HOSTS_LOG, [$columns=Info, $ev=log_known_hosts]); Log::create_stream(Known::HOSTS_LOG, [$columns=HostsInfo, $ev=log_known_hosts]);
} }
event connection_established(c: connection) &priority=5 event connection_established(c: connection) &priority=5

8
scripts/policy/protocols/conn/known-services.bro
View file

@ -10,7 +10,7 @@ module Known;
export { export {
redef enum Log::ID += { SERVICES_LOG }; redef enum Log::ID += { SERVICES_LOG };
type Info: record { type ServicesInfo: record {
ts: time &log; ts: time &log;
host: addr &log; host: addr &log;
port_num: port &log; port_num: port &log;
@ -25,7 +25,7 @@ export {
global known_services: set[addr, port] &create_expire=1day &synchronized; global known_services: set[addr, port] &create_expire=1day &synchronized;
global log_known_services: event(rec: Info); global log_known_services: event(rec: ServicesInfo);
} }
redef record connection += { redef record connection += {
@ -35,7 +35,7 @@ redef record connection += {
event bro_init() &priority=5 event bro_init() &priority=5
{ {
Log::create_stream(Known::SERVICES_LOG, [$columns=Info, Log::create_stream(Known::SERVICES_LOG, [$columns=ServicesInfo,
$ev=log_known_services]); $ev=log_known_services]);
} }
@ -48,7 +48,7 @@ function known_services_done(c: connection)
[id$resp_h, id$resp_p] !in known_services && [id$resp_h, id$resp_p] !in known_services &&
"ftp-data" !in c$service ) # don't include ftp data sessions "ftp-data" !in c$service ) # don't include ftp data sessions
{ {
local i: Info; local i: ServicesInfo;
i$ts=c$start_time; i$ts=c$start_time;
i$host=id$resp_h; i$host=id$resp_h;
i$port_num=id$resp_p; i$port_num=id$resp_p;

6
scripts/policy/protocols/ssl/known-certs.bro
View file

@ -5,7 +5,7 @@ module Known;
export { export {
redef enum Log::ID += { CERTS_LOG }; redef enum Log::ID += { CERTS_LOG };
type Info: record { type CertsInfo: record {
## The timestamp when the certificate was detected. ## The timestamp when the certificate was detected.
ts: time &log; ts: time &log;
## The address that offered the certificate. ## The address that offered the certificate.
@ -31,12 +31,12 @@ export {
## in the set is for storing the certificate's serial number. ## in the set is for storing the certificate's serial number.
global known_certs: set[addr, string] &create_expire=1day &synchronized &redef; global known_certs: set[addr, string] &create_expire=1day &synchronized &redef;
global log_known_certs: event(rec: Info); global log_known_certs: event(rec: CertsInfo);
} }
event bro_init() &priority=5 event bro_init() &priority=5
{ {
Log::create_stream(Known::CERTS_LOG, [$columns=Info, $ev=log_known_certs]); Log::create_stream(Known::CERTS_LOG, [$columns=CertsInfo, $ev=log_known_certs]);
} }
event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string) event x509_certificate(c: connection, cert: X509, is_server: bool, chain_idx: count, chain_len: count, der_cert: string)