Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Checkpoint commit. This is all a huge mess right now. :)

Browse source
This commit is contained in:
Seth Hall 2012-09-26 10:08:48 -04:00
parent 78401262d0
commit 50e319a417
9 changed files with 495 additions and 314 deletions
Download patch file Download diff file Expand all files Collapse all files

44
scripts/base/frameworks/intel/plugins/dns_zones.bro
View file

@ -7,36 +7,45 @@ export {
};
}
function dns_zone_ripper(query: Query): Query
function dns_zone_ripper(found: Found): Found
{
local query_copy = copy(query);
local found_copy = copy(found);
## # We only support fourth level depth zones right now for performance.
## if ( /(\.[^\.]+){4,}/ in found_copy$str )
## {
## local parts = split_all(found_copy$str, /\./);
## local len = |parts|;
## found_copy$str = parts[len-6] + "." + parts[len-4] + "." + parts[len-2] + "." + parts[len];
## }
# We can assume that we're getting a string and subtype because
# this function is only registered for DOMAIN and DNS_ZONE data.
local dns_name = sub(query_copy$str, /^[^\.]*\./, "");
query_copy$str = dns_name;
local dns_name = sub(found_copy$str, /^[^\.]*\./, "");
found_copy$str = dns_name;
# We are doing a literal search for a DNS zone at this point
query_copy$subtype = Intel::DNS_ZONE;
return query_copy;
found_copy$str_type = Intel::DNS_ZONE;
return found_copy;
}
# This matcher extension adds additional matchers for domain names.
function dns_zone_matcher(query: Query): bool
function dns_zone_matcher(found: Found): bool
{
local query_copy = dns_zone_ripper(query);
if ( query$str == query_copy$str )
local found_copy = dns_zone_ripper(found);
if ( found$str == found_copy$str )
return F;
return Intel::matcher(query_copy);
return Intel::find(found_copy);
}
function dns_zone_lookup(query: Query): set[Item]
function dns_zone_lookup(found: Found): set[Item]
{
local result_set: set[Item] = set();
local query_copy = dns_zone_ripper(query);
if ( query$str == query_copy$str )
local found_copy = dns_zone_ripper(found);
if ( found$str == found_copy$str )
return result_set;
for ( item in Intel::lookup(query_copy) )
for ( item in Intel::lookup(found_copy) )
add result_set[item];
return result_set;
}
@ -44,10 +53,9 @@ function dns_zone_lookup(query: Query): set[Item]
event bro_init() &priority=10
{
register_custom_matcher(DOMAIN, dns_zone_matcher);
# The DNS_ZONE subtype needs added because it's ultimately
# a subset of DOMAIN and will need to be searched as well.
register_custom_matcher(DNS_ZONE, dns_zone_matcher);
register_custom_lookup(DOMAIN, dns_zone_lookup);
## The DNS_ZONE subtype needs added because it's ultimately
## a subset of DOMAIN and will need to be searched as well.
register_custom_matcher(DNS_ZONE, dns_zone_matcher);
register_custom_lookup(DNS_ZONE, dns_zone_lookup);
}

19
scripts/base/frameworks/intel/plugins/set.bro Normal file
View file

@ -0,0 +1,19 @@
module Intel;
redef record Intel::Indexes += {
hosts: set[addr] &default=set();
strings: set[string, SubType] &default=set();
};
redef plugins += {
[$index() = {
},
$match(found: Found): bool = {
},
$lookup(found: Found): set[Item] = {
}
]
};