mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 11:08:20 +00:00
Merge remote-tracking branch 'origin/topic/jsiwek/udp_content_delivery_ports_use_resp'
* origin/topic/jsiwek/udp_content_delivery_ports_use_resp: Add "udp_content_ports" option Add new "udp_content_delivery_ports_use_resp" option
This commit is contained in:
Johanna Amann
commit
4ee84b69f2
13 changed files with 113 additions and 22 deletions
14
CHANGES
14
CHANGES
|
|
@ -1,4 +1,18 @@
|
|||
|
||||
3.2.0-dev.360 | 2020-04-07 14:12:27 -0700
|
||||
|
||||
* Add "udp_content_ports" option
|
||||
|
||||
Any port in that set found as either source or destination port
|
||||
of a UDP packet will cause the "udp_contents" event to be raised. (Jon Siwek, Corelight)
|
||||
|
||||
* Add new "udp_content_delivery_ports_use_resp" option
|
||||
|
||||
This controls whether ports given by "udp_content_delivery_ports_orig" and
|
||||
"udp_content_delivery_ports_orig" are in terms of the UDP packet's
|
||||
destination port or by the Connection's "responder" port (the former is
|
||||
the unchanged default behavior). (Jon Siwek, Corelight)
|
||||
|
||||
3.2.0-dev.357 | 2020-04-07 13:43:38 -0700
|
||||
|
||||
* Fix connection duration thresholding
|
||||
|
|
|
|||
8
NEWS
8
NEWS
|
|
@ -29,6 +29,14 @@ New Functionality
|
|||
detected, but also provides a few other events related to the RDPEUDP
|
||||
connection establishment.
|
||||
|
||||
- Add the ``udp_content_ports`` configuration option. Any port added to
|
||||
this set will cause the ``udp_contents`` event to be raised.
|
||||
|
||||
- Add the ``udp_content_delivery_ports_use_resp`` option which can be used
|
||||
to specify how the destination port for the ``udp_content_delivery_ports_orig``
|
||||
and ``udp_content_delivery_ports_orig`` options is determined. The current value
|
||||
keeps behavior as it was in previous versions of Zeek.
|
||||
|
||||
Changed Functionality
|
||||
---------------------
|
||||
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
3.2.0-dev.357
|
||||
3.2.0-dev.360
|
||||
|
|
|
|||
2
doc
2
doc
|
|
@ -1 +1 @@
|
|||
Subproject commit 26b923f841f98238f68756e91083bef7a3004b0c
|
||||
Subproject commit 9b976943a56578b86762def2f10a1f33bd69079f
|
||||
|
|
@ -1116,6 +1116,7 @@ const tcp_content_deliver_all_resp = F &redef;
|
|||
## tcp_content_deliver_all_orig tcp_content_deliver_all_resp
|
||||
## udp_content_delivery_ports_resp udp_content_deliver_all_orig
|
||||
## udp_content_deliver_all_resp udp_contents
|
||||
## udp_content_delivery_ports_use_resp udp_content_ports
|
||||
const udp_content_delivery_ports_orig: table[port] of bool = {} &redef;
|
||||
|
||||
## Defines UDP destination ports for which the contents of the responder stream
|
||||
|
|
@ -1125,8 +1126,26 @@ const udp_content_delivery_ports_orig: table[port] of bool = {} &redef;
|
|||
## tcp_content_delivery_ports_resp tcp_content_deliver_all_orig
|
||||
## tcp_content_deliver_all_resp udp_content_delivery_ports_orig
|
||||
## udp_content_deliver_all_orig udp_content_deliver_all_resp udp_contents
|
||||
## udp_content_delivery_ports_use_resp udp_content_ports
|
||||
const udp_content_delivery_ports_resp: table[port] of bool = {} &redef;
|
||||
|
||||
## Defines UDP ports (source or destination) for which the contents of
|
||||
## either originator or responder streams should be delivered via
|
||||
## :zeek:see:`udp_contents`.
|
||||
##
|
||||
## .. zeek:see:: tcp_content_delivery_ports_orig
|
||||
## tcp_content_delivery_ports_resp tcp_content_deliver_all_orig
|
||||
## tcp_content_deliver_all_resp udp_content_delivery_ports_orig
|
||||
## udp_content_deliver_all_orig udp_content_deliver_all_resp udp_contents
|
||||
## udp_content_delivery_ports_use_resp udp_content_delivery_ports_resp
|
||||
option udp_content_ports: set[port] = {};
|
||||
|
||||
## Whether ports given in :zeek:see:`udp_content_delivery_ports_orig`
|
||||
## and :zeek:see:`udp_content_delivery_ports_resp` are in terms of
|
||||
## UDP packet's destination port or the UDP connection's "responder"
|
||||
## port.
|
||||
option udp_content_delivery_ports_use_resp = F;
|
||||
|
||||
## If true, all UDP originator-side traffic is reported via
|
||||
## :zeek:see:`udp_contents`.
|
||||
##
|
||||
|
|
@ -1135,6 +1154,7 @@ const udp_content_delivery_ports_resp: table[port] of bool = {} &redef;
|
|||
## tcp_content_delivery_ports_orig udp_content_delivery_ports_orig
|
||||
## udp_content_delivery_ports_resp udp_content_deliver_all_resp
|
||||
## udp_contents
|
||||
## udp_content_delivery_ports_use_resp
|
||||
const udp_content_deliver_all_orig = F &redef;
|
||||
|
||||
## If true, all UDP responder-side traffic is reported via
|
||||
|
|
@ -1145,6 +1165,7 @@ const udp_content_deliver_all_orig = F &redef;
|
|||
## tcp_content_delivery_ports_orig udp_content_delivery_ports_orig
|
||||
## udp_content_delivery_ports_resp udp_content_deliver_all_orig
|
||||
## udp_contents
|
||||
## udp_content_delivery_ports_use_resp
|
||||
const udp_content_deliver_all_resp = F &redef;
|
||||
|
||||
## Check for expired table entries after this amount of time.
|
||||
|
|
|
|||
|
|
@ -75,8 +75,10 @@ bool tcp_content_deliver_all_resp;
|
|||
|
||||
TableVal* udp_content_delivery_ports_orig;
|
||||
TableVal* udp_content_delivery_ports_resp;
|
||||
TableVal* udp_content_ports;
|
||||
bool udp_content_deliver_all_orig;
|
||||
bool udp_content_deliver_all_resp;
|
||||
bool udp_content_delivery_ports_use_resp;
|
||||
|
||||
double dns_session_timeout;
|
||||
double rpc_timeout;
|
||||
|
|
@ -319,10 +321,14 @@ void init_net_var()
|
|||
internal_val("udp_content_delivery_ports_orig")->AsTableVal();
|
||||
udp_content_delivery_ports_resp =
|
||||
internal_val("udp_content_delivery_ports_resp")->AsTableVal();
|
||||
udp_content_ports =
|
||||
internal_val("udp_content_ports")->AsTableVal();
|
||||
udp_content_deliver_all_orig =
|
||||
bool(internal_val("udp_content_deliver_all_orig")->AsBool());
|
||||
udp_content_deliver_all_resp =
|
||||
bool(internal_val("udp_content_deliver_all_resp")->AsBool());
|
||||
udp_content_delivery_ports_use_resp =
|
||||
bool(internal_val("udp_content_delivery_ports_use_resp")->AsBool());
|
||||
|
||||
dns_session_timeout = opt_internal_double("dns_session_timeout");
|
||||
rpc_timeout = opt_internal_double("rpc_timeout");
|
||||
|
|
|
|||
|
|
@ -75,8 +75,10 @@ extern bool tcp_content_deliver_all_resp;
|
|||
|
||||
extern TableVal* udp_content_delivery_ports_orig;
|
||||
extern TableVal* udp_content_delivery_ports_resp;
|
||||
extern TableVal* udp_content_ports;
|
||||
extern bool udp_content_deliver_all_orig;
|
||||
extern bool udp_content_deliver_all_resp;
|
||||
extern bool udp_content_delivery_ports_use_resp;
|
||||
|
||||
extern double dns_session_timeout;
|
||||
extern double rpc_timeout;
|
||||
|
|
|
|||
|
|
@ -134,22 +134,33 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
|
|||
|
||||
if ( udp_contents )
|
||||
{
|
||||
auto port_val = val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP);
|
||||
bool do_udp_contents = false;
|
||||
auto sport_val = IntrusivePtr{AdoptRef{}, val_mgr->GetPort(ntohs(up->uh_sport), TRANSPORT_UDP)};
|
||||
auto dport_val = IntrusivePtr{AdoptRef{}, val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP)};
|
||||
|
||||
if ( is_orig )
|
||||
{
|
||||
auto result = udp_content_delivery_ports_orig->Lookup(port_val);
|
||||
|
||||
if ( udp_content_deliver_all_orig || (result && result->AsBool()) )
|
||||
do_udp_contents = true;
|
||||
}
|
||||
if ( udp_content_ports->Lookup(dport_val.get()) ||
|
||||
udp_content_ports->Lookup(sport_val.get()) )
|
||||
do_udp_contents = true;
|
||||
else
|
||||
{
|
||||
auto result = udp_content_delivery_ports_resp->Lookup(port_val);
|
||||
uint16_t p = udp_content_delivery_ports_use_resp ? Conn()->RespPort()
|
||||
: up->uh_dport;
|
||||
auto port_val = IntrusivePtr{AdoptRef{}, val_mgr->GetPort(ntohs(p), TRANSPORT_UDP)};
|
||||
|
||||
if ( udp_content_deliver_all_resp || (result && result->AsBool()) )
|
||||
do_udp_contents = true;
|
||||
if ( is_orig )
|
||||
{
|
||||
auto result = udp_content_delivery_ports_orig->Lookup(port_val.get());
|
||||
|
||||
if ( udp_content_deliver_all_orig || (result && result->AsBool()) )
|
||||
do_udp_contents = true;
|
||||
}
|
||||
else
|
||||
{
|
||||
auto result = udp_content_delivery_ports_resp->Lookup(port_val.get());
|
||||
|
||||
if ( udp_content_deliver_all_resp || (result && result->AsBool()) )
|
||||
do_udp_contents = true;
|
||||
}
|
||||
}
|
||||
|
||||
if ( do_udp_contents )
|
||||
|
|
@ -158,8 +169,6 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
|
|||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
||||
make_intrusive<StringVal>(len, (const char*) data)
|
||||
);
|
||||
|
||||
Unref(port_val);
|
||||
}
|
||||
|
||||
if ( is_orig )
|
||||
|
|
|
|||
2
testing/btest/Baseline/core.udp-content-ports/out
Normal file
2
testing/btest/Baseline/core.udp-content-ports/out
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
Contents:, [orig_h=202.77.162.213, orig_p=54790/udp, resp_h=172.16.115.20, resp_p=111/udp], T, 56
|
||||
Contents:, [orig_h=202.77.162.213, orig_p=54790/udp, resp_h=172.16.115.20, resp_p=111/udp], F, 28
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
Contents:, [orig_h=172.16.115.20, orig_p=111/udp, resp_h=202.77.162.213, resp_p=54790/udp], F, 56
|
||||
Contents:, [orig_h=172.16.115.20, orig_p=111/udp, resp_h=202.77.162.213, resp_p=54790/udp], T, 28
|
||||
|
|
@ -282,7 +282,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Config::LOG)) -> <no result>
|
||||
|
|
@ -463,7 +463,7 @@
|
|||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(NetControl::init, <null>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
|
||||
|
|
@ -547,6 +547,8 @@
|
|||
0.000000 MetaHookPost CallFunction(Option::set_change_handler, <frame>, (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Option::set_change_handler, <frame>, (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Option::set_change_handler, <frame>, (default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Option::set_change_handler, <frame>, (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(Option::set_change_handler, <frame>, (udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketFilter::build, <frame>, ()) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, )) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketFilter::install, <frame>, ()) -> <no result>
|
||||
|
|
@ -1198,7 +1200,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Broker::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
|
||||
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Config::LOG))
|
||||
|
|
@ -1379,7 +1381,7 @@
|
|||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
|
||||
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T]))
|
||||
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(NetControl::init, <null>, ())
|
||||
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
|
||||
|
|
@ -1463,6 +1465,8 @@
|
|||
0.000000 MetaHookPre CallFunction(Option::set_change_handler, <frame>, (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100))
|
||||
0.000000 MetaHookPre CallFunction(Option::set_change_handler, <frame>, (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100))
|
||||
0.000000 MetaHookPre CallFunction(Option::set_change_handler, <frame>, (default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100))
|
||||
0.000000 MetaHookPre CallFunction(Option::set_change_handler, <frame>, (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100))
|
||||
0.000000 MetaHookPre CallFunction(Option::set_change_handler, <frame>, (udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100))
|
||||
0.000000 MetaHookPre CallFunction(PacketFilter::build, <frame>, ())
|
||||
0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, ))
|
||||
0.000000 MetaHookPre CallFunction(PacketFilter::install, <frame>, ())
|
||||
|
|
@ -2113,7 +2117,7 @@
|
|||
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
|
||||
0.000000 | HookCallFunction Log::add_default_filter(Config::LOG)
|
||||
|
|
@ -2294,7 +2298,7 @@
|
|||
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
|
||||
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
|
||||
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T])
|
||||
0.000000 | HookCallFunction NetControl::check_plugins()
|
||||
0.000000 | HookCallFunction NetControl::init()
|
||||
0.000000 | HookCallFunction Notice::want_pp()
|
||||
|
|
@ -2378,6 +2382,8 @@
|
|||
0.000000 | HookCallFunction Option::set_change_handler(X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)
|
||||
0.000000 | HookCallFunction Option::set_change_handler(default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)
|
||||
0.000000 | HookCallFunction Option::set_change_handler(default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)
|
||||
0.000000 | HookCallFunction Option::set_change_handler(udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)
|
||||
0.000000 | HookCallFunction Option::set_change_handler(udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)
|
||||
0.000000 | HookCallFunction PacketFilter::build()
|
||||
0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, )
|
||||
0.000000 | HookCallFunction PacketFilter::install()
|
||||
|
|
@ -2741,7 +2747,7 @@
|
|||
0.000000 | HookLoadFile base<...>/xmpp
|
||||
0.000000 | HookLoadFile base<...>/zeek.bif.zeek
|
||||
0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)}
|
||||
0.000000 | HookLogWrite packet_filter [ts=1585876138.391469, node=zeek, filter=ip or not ip, init=T, success=T]
|
||||
0.000000 | HookLogWrite packet_filter [ts=1586289531.944197, node=zeek, filter=ip or not ip, init=T, success=T]
|
||||
0.000000 | HookQueueEvent NetControl::init()
|
||||
0.000000 | HookQueueEvent filter_change_tracking()
|
||||
0.000000 | HookQueueEvent zeek_init()
|
||||
|
|
|
|||
9
testing/btest/core/udp-content-ports.zeek
Normal file
9
testing/btest/core/udp-content-ports.zeek
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
# @TEST-EXEC: zeek -b -r $TRACES/rpc-portmap-sadmind.pcap %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
redef udp_content_ports += { 54790/udp };
|
||||
|
||||
event udp_contents(c: connection, is_orig: bool, contents: string)
|
||||
{
|
||||
print "Contents:", c$id, is_orig, |contents|;
|
||||
}
|
||||
12
testing/btest/core/udp-contents-delivery-ports-use-resp.zeek
Normal file
12
testing/btest/core/udp-contents-delivery-ports-use-resp.zeek
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
# @TEST-EXEC: zeek -b -r $TRACES/rpc-portmap-sadmind.pcap %INPUT >out
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
redef udp_content_delivery_ports_use_resp = T;
|
||||
redef udp_content_delivery_ports_orig += {[54790/udp] = T};
|
||||
redef udp_content_delivery_ports_resp += {[54790/udp] = T};
|
||||
redef likely_server_ports += {54790/udp};
|
||||
|
||||
event udp_contents(c: connection, is_orig: bool, contents: string)
|
||||
{
|
||||
print "Contents:", c$id, is_orig, |contents|;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue