mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Add a test that checks each individual script can be loaded in bare-mode.
Fixed most @load dependency issues in the process. The test is still failing in a "known" way due to hot.conn.bro and scan.bro. Adressess #545
This commit is contained in:
Jon Siwek
parent
78e69a0bc8
commit
47500ceef4
81 changed files with 203 additions and 50 deletions
|
|
@ -1,3 +1,4 @@
|
|||
@load base/frameworks/control/main
|
||||
|
||||
module Cluster;
|
||||
|
||||
|
|
@ -65,4 +66,4 @@ event bro_init()
|
|||
}
|
||||
|
||||
Log::create_stream(CLUSTER, [$columns=Info]);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,6 +8,8 @@
|
|||
##! This is where the cluster manager sets it's specific settings for other
|
||||
##! frameworks and in the core.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
@prefixes += cluster-manager
|
||||
|
||||
## Turn off remote logging since this is the manager and should only log here.
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load base/frameworks/notice/main
|
||||
|
||||
@prefixes += cluster-worker
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
@load ./main
|
||||
@load base/frameworks/communication/main
|
||||
|
||||
module Cluster;
|
||||
|
||||
event bro_init() &priority=9
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
##! Connect to remote Bro or Broccoli instances to share state and/or transfer
|
||||
##! events.
|
||||
|
||||
@load base/frameworks/packet-filter/main
|
||||
|
||||
module Communication;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -20,6 +20,8 @@
|
|||
# canary
|
||||
# friend
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module Intel;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! This is the implementation of the metrics framework.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module Metrics;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
##! This script extends the built in notice code to implement the IP address
|
||||
##! dropping functionality.
|
||||
|
||||
@load ../main
|
||||
|
||||
module Notice;
|
||||
|
||||
export {
|
||||
|
|
@ -31,4 +33,4 @@ event bro_init()
|
|||
};
|
||||
|
||||
add Notice::sync_functions[drop_func];
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load ../main
|
||||
@load base/utils/site
|
||||
|
||||
module Notice;
|
||||
|
||||
|
|
@ -25,4 +27,4 @@ event notice(n: Notice::Info) &priority=-5
|
|||
if ( email != "" )
|
||||
email_notice_to(n, email, T);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load ../main
|
||||
|
||||
module Notice;
|
||||
|
||||
|
|
@ -16,4 +17,4 @@ event notice(n: Notice::Info) &priority=-5
|
|||
{
|
||||
if ( ACTION_PAGE in n$actions )
|
||||
email_notice_to(n, mail_page_dest, F);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load ../main
|
||||
|
||||
module Notice;
|
||||
|
||||
|
|
@ -8,7 +9,7 @@ event Notice::notice(n: Notice::Info) &priority=10
|
|||
return;
|
||||
|
||||
# This should only be done for notices that are being sent to email.
|
||||
if ( ACTION_EMAIL !in n$action )
|
||||
if ( ACTION_EMAIL !in n$actions )
|
||||
return;
|
||||
|
||||
local output = "";
|
||||
|
|
@ -37,4 +38,4 @@ event Notice::notice(n: Notice::Info) &priority=10
|
|||
|
||||
if ( output != "" )
|
||||
n$email_body_sections[|n$email_body_sections|] = output;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
@load base/utils/conn-ids
|
||||
@load base/utils/site
|
||||
@load ./main
|
||||
|
||||
module Weird;
|
||||
|
||||
|
|
|
|||
|
|
@ -4,6 +4,8 @@
|
|||
##! open filter and all filters defined in Bro scripts with the
|
||||
##! :bro:id:`capture_filters` and :bro:id:`restrict_filters` variables.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module PacketFilter;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! This script reports on packet loss from the various packet sources.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module PacketFilter;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Script level signature support.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module Signatures;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -4,6 +4,9 @@
|
|||
##! that they analyze. The entry point for providing new software detections
|
||||
##! to this framework is through the :bro:id:`Software::found` function.
|
||||
|
||||
@load base/utils/directions-and-hosts
|
||||
@load base/utils/numbers
|
||||
|
||||
module Software;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -8,6 +8,8 @@
|
|||
##! This script does not work well in a cluster context unless it has a
|
||||
##! remotely mounted disk to write the content files to.
|
||||
|
||||
@load base/utils/files
|
||||
|
||||
module Conn;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load base/utils/site
|
||||
|
||||
module Conn;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load ./consts
|
||||
|
||||
module DNS;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
##! File extraction for FTP.
|
||||
|
||||
@load ./main
|
||||
@load base/utils/files
|
||||
|
||||
module FTP;
|
||||
|
||||
export {
|
||||
|
|
@ -62,4 +65,4 @@ event log_ftp(rec: Info) &priority=-10
|
|||
{
|
||||
delete rec$extraction_file;
|
||||
delete rec$extract_file;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,6 +7,10 @@
|
|||
##!
|
||||
##! * Handle encrypted sessions correctly (get an example?)
|
||||
|
||||
@load ./utils-commands
|
||||
@load base/utils/paths
|
||||
@load base/utils/numbers
|
||||
|
||||
module FTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,10 @@
|
|||
##! Extracts the items from HTTP traffic, one per file. At this time only
|
||||
##! the message body from the server can be extracted with this script.
|
||||
|
||||
@load ./main
|
||||
@load ./file-ident
|
||||
@load base/utils/files
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Calculate hashes for HTTP body transfers.
|
||||
|
||||
@load ./file-ident
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,11 @@
|
|||
##! This script is involved in the identification of file types in HTTP
|
||||
##! response bodies.
|
||||
|
||||
@load base/frameworks/signatures/main
|
||||
@load base/frameworks/notice/main
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
|
||||
# Add the magic number signatures to the core signature set.
|
||||
redef signature_files += "base/protocols/http/file-ident.sig";
|
||||
# Ignore the signatures used to match files
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load base/utils/numbers
|
||||
|
||||
module HTTP;
|
||||
|
||||
|
|
|
|||
|
|
@ -3,6 +3,10 @@
|
|||
##!
|
||||
##! This script doesn't work yet and isn't loaded by default.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
@load ./main
|
||||
@load ./utils
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Utilities specific for HTTP processing.
|
||||
|
||||
@load ./main
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -8,6 +8,9 @@
|
|||
##! Example line from IRC server indicating that the DCC SEND is about to start:
|
||||
##! PRIVMSG my_nick :^ADCC SEND whateverfile.zip 3640061780 1026 41709^A
|
||||
|
||||
@load ./main
|
||||
@load base/utils/files
|
||||
|
||||
module IRC;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
@load protocols/mime/base
|
||||
@load protocols/mime/file-ident
|
||||
@load protocols/mime/file-extract
|
||||
@load protocols/mime/file-hash
|
||||
@load ./base
|
||||
@load ./file-ident
|
||||
@load ./file-extract
|
||||
@load ./file-hash
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
##! The mime script does analysis of MIME encoded messages seen in certain
|
||||
##! protocols (only SMTP and POP3 at the moment).
|
||||
|
||||
@load utils/strings
|
||||
@load base/utils/strings
|
||||
|
||||
module MIME;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
@load protocols/mime/file-ident
|
||||
@load utils/files
|
||||
@load ./file-ident
|
||||
@load base/utils/files
|
||||
|
||||
module MIME;
|
||||
|
||||
|
|
@ -57,4 +57,4 @@ event mime_end_entity(c: connection) &priority=-3
|
|||
if ( c$mime?$extraction_file )
|
||||
close(c$mime$extraction_file);
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
@load protocols/mime/file-ident
|
||||
@load ./file-ident
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module MIME;
|
||||
|
||||
|
|
@ -75,4 +76,4 @@ event mime_end_entity(c: connection) &priority=-3
|
|||
NOTICE([$note=MD5, $msg=fmt("Calculated a hash for a MIME entity from %s", c$id$orig_h),
|
||||
$sub=c$mime$md5, $conn=c]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
@load protocols/mime/base
|
||||
@load ./base
|
||||
|
||||
module MIME;
|
||||
|
||||
|
|
|
|||
|
|
@ -8,6 +8,8 @@
|
|||
# programs for which we don't have an analyzer.
|
||||
#
|
||||
|
||||
@load base/utils/conn-ids
|
||||
|
||||
module RPC;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/utils/addrs
|
||||
@load base/utils/directions-and-hosts
|
||||
|
||||
module SMTP;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/utils/site
|
||||
@load base/utils/thresholds
|
||||
@load base/utils/conn-ids
|
||||
|
||||
module SSH;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load ./consts
|
||||
@load base/frameworks/notice/main
|
||||
|
||||
module SSL;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Don't edit! This file is automatically generated.
|
||||
# Generated at: Wed Jun 29 07:52:38 -0400 2011
|
||||
|
||||
@load base/protocols/ssl/main
|
||||
module SSL;
|
||||
redef root_certs += {
|
||||
["GTE CyberTrust Global Root"] = "\x30\x82\x02\x5A\x30\x82\x01\xC3\x02\x02\x01\xA5\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x04\x05\x00\x30\x75\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x18\x30\x16\x06\x03\x55\x04\x0A\x13\x0F\x47\x54\x45\x20\x43\x6F\x72\x70\x6F\x72\x61\x74\x69\x6F\x6E\x31\x27\x30\x25\x06\x03\x55\x04\x0B\x13\x1E\x47\x54\x45\x20\x43\x79\x62\x65\x72\x54\x72\x75\x73\x74\x20\x53\x6F\x6C\x75\x74\x69\x6F\x6E\x73\x2C\x20\x49\x6E\x63\x2E\x31\x23\x30\x21\x06\x03\x55\x04\x03\x13\x1A\x47\x54\x45\x20\x43\x79\x62\x65\x72\x54\x72\x75\x73\x74\x20\x47\x6C\x6F\x62\x61\x6C\x20\x52\x6F\x6F\x74\x30\x1E\x17\x0D\x39\x38\x30\x38\x31\x33\x30\x30\x32\x39\x30\x30\x5A\x17\x0D\x31\x38\x30\x38\x31\x33\x32\x33\x35\x39\x30\x30\x5A\x30\x75\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x18\x30\x16\x06\x03\x55\x04\x0A\x13\x0F\x47\x54\x45\x20\x43\x6F\x72\x70\x6F\x72\x61\x74\x69\x6F\x6E\x31\x27\x30\x25\x06\x03\x55\x04\x0B\x13\x1E\x47\x54\x45\x20\x43\x79\x62\x65\x72\x54\x72\x75\x73\x74\x20\x53\x6F\x6C\x75\x74\x69\x6F\x6E\x73\x2C\x20\x49\x6E\x63\x2E\x31\x23\x30\x21\x06\x03\x55\x04\x03\x13\x1A\x47\x54\x45\x20\x43\x79\x62\x65\x72\x54\x72\x75\x73\x74\x20\x47\x6C\x6F\x62\x61\x6C\x20\x52\x6F\x6F\x74\x30\x81\x9F\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01\x05\x00\x03\x81\x8D\x00\x30\x81\x89\x02\x81\x81\x00\x95\x0F\xA0\xB6\xF0\x50\x9C\xE8\x7A\xC7\x88\xCD\xDD\x17\x0E\x2E\xB0\x94\xD0\x1B\x3D\x0E\xF6\x94\xC0\x8A\x94\xC7\x06\xC8\x90\x97\xC8\xB8\x64\x1A\x7A\x7E\x6C\x3C\x53\xE1\x37\x28\x73\x60\x7F\xB2\x97\x53\x07\x9F\x53\xF9\x6D\x58\x94\xD2\xAF\x8D\x6D\x88\x67\x80\xE6\xED\xB2\x95\xCF\x72\x31\xCA\xA5\x1C\x72\xBA\x5C\x02\xE7\x64\x42\xE7\xF9\xA9\x2C\xD6\x3A\x0D\xAC\x8D\x42\xAA\x24\x01\x39\xE6\x9C\x3F\x01\x85\x57\x0D\x58\x87\x45\xF8\xD3\x85\xAA\x93\x69\x26\x85\x70\x48\x80\x3F\x12\x15\xC7\x79\xB4\x1F\x05\x2F\x3B\x62\x99\x02\x03\x01\x00\x01\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x04\x05\x00\x03\x81\x81\x00\x6D\xEB\x1B\x09\xE9\x5E\xD9\x51\xDB\x67\x22\x61\xA4\x2A\x3C\x48\x77\xE3\xA0\x7C\xA6\xDE\x73\xA2\x14\x03\x85\x3D\xFB\xAB\x0E\x30\xC5\x83\x16\x33\x81\x13\x08\x9E\x7B\x34\x4E\xDF\x40\xC8\x74\xD7\xB9\x7D\xDC\xF4\x76\x55\x7D\x9B\x63\x54\x18\xE9\xF0\xEA\xF3\x5C\xB1\xD9\x8B\x42\x1E\xB9\xC0\x95\x4E\xBA\xFA\xD5\xE2\x7C\xF5\x68\x61\xBF\x8E\xEC\x05\x97\x5F\x5B\xB0\xD7\xA3\x85\x34\xC4\x24\xA7\x0D\x0F\x95\x93\xEF\xCB\x94\xD8\x9E\x1F\x9D\x5C\x85\x6D\xC7\xAA\xAE\x4F\x1F\x22\xB5\xCD\x95\xAD\xBA\xA7\xCC\xF9\xAB\x0B\x7A\x7F",
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load ./site
|
||||
|
||||
type Direction: enum {
|
||||
## The connection originator is not within the locally-monitored network,
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Listen for other Bro instances to make unencrypted connections.
|
||||
|
||||
@load base/frameworks/communication/main
|
||||
|
||||
module Communication;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Listen for other Bro instances and encrypt the connection with SSL.
|
||||
|
||||
@load base/frameworks/communication/main
|
||||
|
||||
module Communication;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
|
||||
@load base/frameworks/control/main
|
||||
# If an instance is a controllee, it implicitly needs to listen for remote
|
||||
# connections.
|
||||
@load frameworks/communication/listen-clear
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/control/main
|
||||
@load base/frameworks/communication/main
|
||||
|
||||
module Control;
|
||||
|
||||
|
|
@ -99,4 +101,4 @@ event remote_connection_handshake_done(p: event_peer) &priority=-10
|
|||
# Signal configuration update to peer.
|
||||
event Control::configuration_update_request();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,9 @@
|
|||
##! Finds connections with protocols on non-standard ports with DPD.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
@load base/utils/site
|
||||
@load base/utils/conn-ids
|
||||
|
||||
module ProtocolDetector;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -4,6 +4,8 @@
|
|||
##! A caveat to logging packet data is that in some cases, the packet may
|
||||
##! not be the packet that actually caused the protocol violation.
|
||||
|
||||
@load base/frameworks/dpd/main
|
||||
|
||||
module DPD;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/metrics/main
|
||||
@load base/utils/site
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
CONNS_ORIGINATED,
|
||||
|
|
@ -17,4 +19,4 @@ event connection_established(c: connection)
|
|||
Metrics::add_data(CONNS_ORIGINATED, [$host=c$id$orig_h]);
|
||||
Metrics::add_data(CONNS_RESPONDED, [$host=c$id$resp_h]);
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
|
||||
@load base/frameworks/metrics/main
|
||||
@load base/protocols/http/main
|
||||
@load base/utils/site
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
HTTP_REQUESTS_BY_STATUS_CODE,
|
||||
|
|
@ -19,4 +21,4 @@ event HTTP::log_http(rec: HTTP::Info)
|
|||
Metrics::add_data(HTTP_REQUESTS_BY_HOST_HEADER, [$index=rec$host]);
|
||||
if ( rec?$status_code )
|
||||
Metrics::add_data(HTTP_REQUESTS_BY_STATUS_CODE, [$host=rec$id$orig_h, $index=fmt("%d", rec$status_code)]);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
|
||||
@load base/frameworks/metrics/main
|
||||
@load base/protocols/ssl/main
|
||||
|
||||
redef enum Metrics::ID += {
|
||||
SSL_SERVERNAME,
|
||||
|
|
@ -19,4 +20,4 @@ event SSL::log_ssl(rec: SSL::Info)
|
|||
{
|
||||
if ( rec?$server_name )
|
||||
Metrics::add_data(SSL_SERVERNAME, [$index=rec$server_name]);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/frameworks/software/main
|
||||
|
||||
module Software;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/frameworks/software/main
|
||||
|
||||
module Software;
|
||||
|
||||
|
|
@ -18,4 +20,4 @@ event log_software(rec: Info)
|
|||
{
|
||||
NOTICE([$note=Vulnerable_Version, $src=rec$host, $msg=software_fmt(rec)]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,2 @@
|
|||
@load integration/barnyard2/types
|
||||
@load integration/barnyard2/event
|
||||
@load integration/barnyard2/base
|
||||
@load ./types
|
||||
@load ./base
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
##! Barnyard2 and logs them. In the future it will do more correlation
|
||||
##! and derive new notices from the alerts.
|
||||
|
||||
@load integration/barnyard2/types
|
||||
@load ./types
|
||||
|
||||
module Barnyard2;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
## This is the event that Barnyard2 instances will send if they're
|
||||
## configured with the bro_alert output plugin.
|
||||
global barnyard_alert: event(id: Barnyard2::PacketID, alert: Barnyard2::AlertData, msg: string, data: string);
|
||||
|
|
@ -22,4 +22,11 @@ export {
|
|||
dst_ip: addr;
|
||||
dst_p: port;
|
||||
} &log;
|
||||
}
|
||||
|
||||
## This is the event that Barnyard2 instances will send if they're
|
||||
## configured with the bro_alert output plugin.
|
||||
global barnyard_alert: event(id: Barnyard2::PacketID,
|
||||
alert: Barnyard2::AlertData,
|
||||
msg: string,
|
||||
data: string);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,6 +3,8 @@
|
|||
##! output provides an easy way to determine a count of the IP addresses in
|
||||
##! use on a network per day.
|
||||
|
||||
@load base/utils/directions-and-hosts
|
||||
|
||||
module KnownHosts;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -3,6 +3,8 @@
|
|||
##! completed a TCP handshake with another host. If a protocol is detected
|
||||
##! during the session, the protocol will also be logged.
|
||||
|
||||
@load base/utils/directions-and-hosts
|
||||
|
||||
module KnownServices;
|
||||
|
||||
redef enum Log::ID += { KNOWN_SERVICES };
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
@load frameworks/notice
|
||||
@load base/frameworks/notice/main
|
||||
@load port-name
|
||||
|
||||
module Scan;
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load base/protocols/dns/main
|
||||
|
||||
redef dns_skip_all_auth = F;
|
||||
redef dns_skip_all_addl = F;
|
||||
|
|
|
|||
|
|
@ -8,6 +8,9 @@
|
|||
##! to be within a local zone. :bro:id:`local_zones` variable **must**
|
||||
##! be set appropriately for this detection.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
@load base/utils/site
|
||||
|
||||
module DNS;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/protocols/ftp/main
|
||||
|
||||
module FTP;
|
||||
|
||||
|
|
@ -21,4 +23,4 @@ event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &prior
|
|||
NOTICE([$note=Site_Exec_Success, $conn=c,
|
||||
$msg=fmt("%s %s", c$ftp$cmdarg$cmd, c$ftp$cmdarg$arg)]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,6 +6,8 @@
|
|||
##! * Detect client software with password given for anonymous users
|
||||
##! (e.g. cyberduck@example.net)
|
||||
|
||||
@load base/frameworks/software/main
|
||||
|
||||
module FTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -4,6 +4,11 @@
|
|||
##! documentation for the protocols/http/file-hash.bro script to see how to
|
||||
##! configure which transfers will have hashes calculated.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
@load base/protocols/http/file-hash
|
||||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## If the MD5 sum of a file transferred over HTTP
|
||||
|
|
|
|||
|
|
@ -1,5 +1,9 @@
|
|||
##! Intelligence based HTTP detections.
|
||||
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
@load base/frameworks/intel/main
|
||||
|
||||
module HTTP;
|
||||
|
||||
event log_http(rec: Info)
|
||||
|
|
@ -14,4 +18,4 @@ event log_http(rec: Info)
|
|||
$sub=HTTP::build_url_http(rec),
|
||||
$id=rec$id]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,9 @@
|
|||
##! SQL injection detection in HTTP.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
@load base/frameworks/metrics/main
|
||||
@load base/protocols/http/main
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
@ -54,4 +58,4 @@ event http_request(c: connection, method: string, original_URI: string,
|
|||
Metrics::add_data(SQL_ATTACKS, [$host=c$id$orig_h]);
|
||||
Metrics::add_data(SQL_ATTACKS_AGAINST, [$host=c$id$resp_h]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
@load base/frameworks/signatures/main
|
||||
@load base/frameworks/software/main
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
|
||||
module HTTP;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Extract and include the header keys used for each request in the log.
|
||||
|
||||
@load base/protocols/http/main
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
##! Software identification and extraction for HTTP traffic.
|
||||
|
||||
@load base/frameworks/software/main
|
||||
|
||||
module HTTP;
|
||||
|
||||
export {
|
||||
|
|
@ -52,4 +54,4 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
|
|||
Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_APPSERVER));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
##! This script extracts and logs variables from cookies sent by clients
|
||||
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
|
||||
module HTTP;
|
||||
|
||||
redef record Info += {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
##! This script extracts and logs variables from the requested URI
|
||||
|
||||
@load base/protocols/http/main
|
||||
@load base/protocols/http/utils
|
||||
|
||||
module HTTP;
|
||||
|
||||
redef record Info += {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/protocols/smtp/main
|
||||
|
||||
module SMTP;
|
||||
|
||||
|
|
|
|||
|
|
@ -7,6 +7,9 @@
|
|||
##! * Find some heuristic to determine if email was sent through
|
||||
##! a MS Exhange webmail interface as opposed to a desktop client.
|
||||
|
||||
@load base/frameworks/software/main
|
||||
@load base/protocols/smtp/main
|
||||
|
||||
module SMTP;
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load base/frameworks/software/main
|
||||
|
||||
module SSH;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
@load base/utils/directions-and-hosts
|
||||
|
||||
module KnownCerts;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
@load base/frameworks/notice/main
|
||||
@load base/protocols/ssl/main
|
||||
|
||||
module SSL;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
##! This strives to tune out high volume and less useful data
|
||||
##! from the notice log.
|
||||
|
||||
@load base/frameworks/notice/main
|
||||
@load base/frameworks/notice/weird
|
||||
|
||||
# Remove these notices from logging since they can be too noisy.
|
||||
redef Notice::ignored_types += {
|
||||
Weird::Content_Gap,
|
||||
|
|
|
|||
|
|
@ -2,8 +2,10 @@
|
|||
##! good to set in most cases or other things that could be done to achieve
|
||||
##! better detection.
|
||||
|
||||
@load base/utils/site
|
||||
|
||||
event bro_init() &priority=-10
|
||||
{
|
||||
if ( |Site::local_nets| == 0 )
|
||||
print "WARNING: No Site::local_nets have been defined. It's usually a good idea to define your local networks.";
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
|
||||
@load base/frameworks/software/main
|
||||
@load protocols/conn/known-hosts
|
||||
@load protocols/conn/known-services
|
||||
@load protocols/ssl/known-certs
|
||||
|
|
|
|||
|
|
@ -19,7 +19,6 @@
|
|||
@load frameworks/software/vulnerable.bro
|
||||
@load integration/barnyard2/__load__.bro
|
||||
@load integration/barnyard2/base.bro
|
||||
@load integration/barnyard2/event.bro
|
||||
@load integration/barnyard2/types.bro
|
||||
@load misc/analysis-groups.bro
|
||||
@load misc/loaded-scripts.bro
|
||||
|
|
|
|||
8
testing/btest/policy/misc/bare-mode-coverage.test
Normal file
8
testing/btest/policy/misc/bare-mode-coverage.test
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# Makes sure any given policy script in the scripts/ tree can be loaded in
|
||||
# bare mode. btest-bg-run/btest-bg-wait are used to kill off scripts that
|
||||
# block after loading, e.g. start listening on a socket.
|
||||
#
|
||||
# @TEST-EXEC: test -e $DIST/scripts
|
||||
# @TEST-EXEC: for script in `find $DIST/scripts -name \*\.bro`; do echo $script;if [[ "$script" =~ listen-clear|listen-ssl|controllee ]]; then rm -rf load_attempt .bgprocs; btest-bg-run load_attempt bro -b $script; btest-bg-wait -k 2; cat load_attempt/.stderr >>allerrors; else bro -b $script 2>>allerrors; fi done || exit 0
|
||||
# @TEST-EXEC: cat allerrors | grep -v "received termination signal" | sort | uniq > unique_errors
|
||||
# @TEST-EXEC: btest-diff unique_errors
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# Makes sures test-all-policy.bro (which loads *all* other policy scripts)
|
||||
# compiles correctly even in bare mode.
|
||||
#
|
||||
# @TEST-EXEC: bro -b %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
@load test-all-policy
|
||||
Loading…
Add table
Add a link
Reference in a new issue