mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 20:18:20 +00:00
Merge remote-tracking branch 'origin/topic/jsiwek/gridftp'
* origin/topic/jsiwek/gridftp: Add memory leak unit test for GridFTP. Enable GridFTP detection by default. Track/log SSL client certs. Add analyzer for GSI mechanism of GSSAPI FTP AUTH method. Add an example of a GridFTP data channel detection script.
This commit is contained in:
Robin Sommer
commit
5e12a53ae5
27 changed files with 583 additions and 68 deletions
|
|
@ -3,38 +3,38 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2012-07-27-19-14-29
|
||||
#open 2012-10-08-16-16-08
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1343416469.508262 - ip or not ip T T
|
||||
#close 2012-07-27-19-14-29
|
||||
1349712968.812610 - ip or not ip T T
|
||||
#close 2012-10-08-16-16-08
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2012-07-27-19-14-29
|
||||
#open 2012-10-08-16-16-09
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1343416469.888870 - (((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (tcp port 1080)) or (udp and port 5355)) or (tcp port 22)) or (tcp port 995)) or (port 21)) or (tcp port 25 or tcp port 587)) or (port 6667)) or (tcp port 614)) or (tcp port 990)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T
|
||||
#close 2012-07-27-19-14-29
|
||||
1349712969.042094 - (((((((((((((((((((((((((port 53) or (tcp port 989)) or (tcp port 443)) or (port 6669)) or (udp and port 5353)) or (port 6668)) or (tcp port 1080)) or (udp and port 5355)) or (tcp port 995)) or (tcp port 22)) or (port 21 and port 2811)) or (tcp port 25 or tcp port 587)) or (tcp port 614)) or (tcp port 990)) or (port 6667)) or (udp port 137)) or (tcp port 993)) or (tcp port 5223)) or (port 514)) or (tcp port 585)) or (tcp port 992)) or (tcp port 563)) or (tcp port 994)) or (tcp port 636)) or (tcp and port (80 or 81 or 631 or 1080 or 3138 or 8000 or 8080 or 8888))) or (port 6666) T T
|
||||
#close 2012-10-08-16-16-09
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2012-07-27-19-14-30
|
||||
#open 2012-10-08-16-16-09
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1343416470.252918 - port 42 T T
|
||||
#close 2012-07-27-19-14-30
|
||||
1349712969.270826 - port 42 T T
|
||||
#close 2012-10-08-16-16-09
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2012-07-27-19-14-30
|
||||
#open 2012-10-08-16-16-09
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1343416470.614962 - port 56730 T T
|
||||
#close 2012-07-27-19-14-30
|
||||
1349712969.499878 - port 56730 T T
|
||||
#close 2012-10-08-16-16-09
|
||||
|
|
|
|||
|
|
@ -77,6 +77,7 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/conn/./main.bro
|
||||
scripts/base/protocols/conn/./contents.bro
|
||||
scripts/base/protocols/conn/./inactivity.bro
|
||||
scripts/base/protocols/conn/./polling.bro
|
||||
scripts/base/protocols/dns/__load__.bro
|
||||
scripts/base/protocols/dns/./consts.bro
|
||||
scripts/base/protocols/dns/./main.bro
|
||||
|
|
@ -84,6 +85,11 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/ftp/./utils-commands.bro
|
||||
scripts/base/protocols/ftp/./main.bro
|
||||
scripts/base/protocols/ftp/./file-extract.bro
|
||||
scripts/base/protocols/ftp/./gridftp.bro
|
||||
scripts/base/protocols/ssl/__load__.bro
|
||||
scripts/base/protocols/ssl/./consts.bro
|
||||
scripts/base/protocols/ssl/./main.bro
|
||||
scripts/base/protocols/ssl/./mozilla-ca-list.bro
|
||||
scripts/base/protocols/http/__load__.bro
|
||||
scripts/base/protocols/http/./main.bro
|
||||
scripts/base/protocols/http/./utils.bro
|
||||
|
|
@ -102,10 +108,6 @@ scripts/base/init-default.bro
|
|||
scripts/base/protocols/socks/./main.bro
|
||||
scripts/base/protocols/ssh/__load__.bro
|
||||
scripts/base/protocols/ssh/./main.bro
|
||||
scripts/base/protocols/ssl/__load__.bro
|
||||
scripts/base/protocols/ssl/./consts.bro
|
||||
scripts/base/protocols/ssl/./main.bro
|
||||
scripts/base/protocols/ssl/./mozilla-ca-list.bro
|
||||
scripts/base/protocols/syslog/__load__.bro
|
||||
scripts/base/protocols/syslog/./consts.bro
|
||||
scripts/base/protocols/syslog/./main.bro
|
||||
|
|
|
|||
|
|
@ -0,0 +1,7 @@
|
|||
new_connection, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp]
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 0
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 1
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 2
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 3
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 4
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 5
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
new_connection, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp]
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 0
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 1
|
||||
callback, [orig_h=192.168.3.103, orig_p=54102/tcp, resp_h=128.146.216.51, resp_p=80/tcp], 2
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2012-10-05-21-45-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool count string count count count count table[string]
|
||||
1348168976.274919 UWkUyAuUGXf 192.168.57.103 60108 192.168.57.101 2811 tcp ssl,ftp,gridftp 0.294743 4491 6659 SF - 0 ShAdDaFf 22 5643 21 7759 (empty)
|
||||
1348168976.546371 arKYeMETxOg 192.168.57.103 35391 192.168.57.101 55968 tcp ssl,gridftp-data 0.011938 2135 3196 S1 - 0 ShADad 8 2559 6 3516 (empty)
|
||||
#close 2012-10-05-21-45-15
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path notice
|
||||
#open 2012-10-05-21-45-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto note msg sub src dst p n peer_descr actions policy_items suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude metric_index.host metric_index.str metric_index.network
|
||||
#types time string addr port addr port enum enum string string addr addr port count string table[enum] table[count] interval bool string string string double double addr string subnet
|
||||
1348168976.558309 arKYeMETxOg 192.168.57.103 35391 192.168.57.101 55968 tcp GridFTP::Data_Channel GridFTP data channel over threshold 2 bytes - 192.168.57.103 192.168.57.101 55968 - bro Notice::ACTION_LOG 6 3600.000000 F - - - - - - - -
|
||||
#close 2012-10-05-21-45-15
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssl
|
||||
#open 2012-10-05-21-45-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id subject issuer_subject not_valid_before not_valid_after last_alert client_subject client_issuer_subject
|
||||
#types time string addr port addr port string string string string string string time time string string string
|
||||
1348168976.508038 UWkUyAuUGXf 192.168.57.103 60108 192.168.57.101 2811 TLSv10 TLS_RSA_WITH_AES_256_CBC_SHA - - CN=host/alpha,OU=simpleCA-alpha,OU=GlobusTest,O=Grid CN=Globus Simple CA,OU=simpleCA-alpha,OU=GlobusTest,O=Grid 1348161979.000000 1379697979.000000 - CN=917532944,CN=Jon Siwek,OU=local,OU=simpleCA-alpha,OU=GlobusTest,O=Grid CN=Jon Siwek,OU=local,OU=simpleCA-alpha,OU=GlobusTest,O=Grid
|
||||
1348168976.551422 arKYeMETxOg 192.168.57.103 35391 192.168.57.101 55968 TLSv10 TLS_RSA_WITH_NULL_SHA - - CN=932373381,CN=917532944,CN=Jon Siwek,OU=local,OU=simpleCA-alpha,OU=GlobusTest,O=Grid CN=917532944,CN=Jon Siwek,OU=local,OU=simpleCA-alpha,OU=GlobusTest,O=Grid 1348168676.000000 1348206441.000000 - CN=917532944,CN=Jon Siwek,OU=local,OU=simpleCA-alpha,OU=GlobusTest,O=Grid CN=Jon Siwek,OU=local,OU=simpleCA-alpha,OU=GlobusTest,O=Grid
|
||||
#close 2012-10-05-21-45-15
|
||||
|
|
@ -3,8 +3,8 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path ssl
|
||||
#open 2012-04-27-14-53-12
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id subject issuer_subject not_valid_before not_valid_after last_alert
|
||||
#types time string addr port addr port string string string string string string time time string
|
||||
1335538392.319381 UWkUyAuUGXf 192.168.1.105 62045 74.125.224.79 443 TLSv10 TLS_ECDHE_RSA_WITH_RC4_128_SHA ssl.gstatic.com - CN=*.gstatic.com,O=Google Inc,L=Mountain View,ST=California,C=US CN=Google Internet Authority,O=Google Inc,C=US 1334102677.000000 1365639277.000000 -
|
||||
#close 2012-04-27-14-53-16
|
||||
#open 2012-10-08-16-18-56
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id subject issuer_subject not_valid_before not_valid_after last_alert client_subject client_issuer_subject
|
||||
#types time string addr port addr port string string string string string string time time string string string
|
||||
1335538392.319381 UWkUyAuUGXf 192.168.1.105 62045 74.125.224.79 443 TLSv10 TLS_ECDHE_RSA_WITH_RC4_128_SHA ssl.gstatic.com - CN=*.gstatic.com,O=Google Inc,L=Mountain View,ST=California,C=US CN=Google Internet Authority,O=Google Inc,C=US 1334102677.000000 1365639277.000000 - - -
|
||||
#close 2012-10-08-16-18-56
|
||||
|
|
|
|||
BIN
testing/btest/Traces/globus-url-copy.trace
Normal file
BIN
testing/btest/Traces/globus-url-copy.trace
Normal file
Binary file not shown.
24
testing/btest/core/leaks/gridftp.test
Normal file
24
testing/btest/core/leaks/gridftp.test
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# Needs perftools support.
|
||||
#
|
||||
# @TEST-REQUIRES: bro --help 2>&1 | grep -q mem-leaks
|
||||
#
|
||||
# @TEST-GROUP: leaks
|
||||
#
|
||||
# @TEST-EXEC: HEAP_CHECK_DUMP_DIRECTORY=. HEAPCHECK=local bro -m -r $TRACES/globus-url-copy.trace %INPUT
|
||||
|
||||
@load base/protocols/ftp/gridftp
|
||||
|
||||
module GridFTP;
|
||||
|
||||
redef size_threshold = 2;
|
||||
|
||||
redef enum Notice::Type += {
|
||||
Data_Channel
|
||||
};
|
||||
|
||||
event GridFTP::data_channel_detected(c: connection)
|
||||
{
|
||||
local msg = fmt("GridFTP data channel over threshold %d bytes",
|
||||
size_threshold);
|
||||
NOTICE([$note=Data_Channel, $msg=msg, $conn=c]);
|
||||
}
|
||||
20
testing/btest/scripts/base/protocols/conn/polling.test
Normal file
20
testing/btest/scripts/base/protocols/conn/polling.test
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/http-100-continue.trace %INPUT >out1
|
||||
# @TEST-EXEC: btest-diff out1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/http-100-continue.trace %INPUT stop_cnt=2 >out2
|
||||
# @TEST-EXEC: btest-diff out2
|
||||
|
||||
@load base/protocols/conn
|
||||
|
||||
const stop_cnt = 10 &redef;
|
||||
|
||||
function callback(c: connection, cnt: count): interval
|
||||
{
|
||||
print "callback", c$id, cnt;
|
||||
return cnt >= stop_cnt ? -1 sec : .2 sec;
|
||||
}
|
||||
|
||||
event new_connection(c: connection)
|
||||
{
|
||||
print "new_connection", c$id;
|
||||
ConnPolling::watch(c, callback, 0, 0secs);
|
||||
}
|
||||
21
testing/btest/scripts/base/protocols/ftp/gridftp.test
Normal file
21
testing/btest/scripts/base/protocols/ftp/gridftp.test
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/globus-url-copy.trace %INPUT
|
||||
# @TEST-EXEC: btest-diff notice.log
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff ssl.log
|
||||
|
||||
@load base/protocols/ftp/gridftp
|
||||
|
||||
module GridFTP;
|
||||
|
||||
redef size_threshold = 2;
|
||||
|
||||
redef enum Notice::Type += {
|
||||
Data_Channel
|
||||
};
|
||||
|
||||
event GridFTP::data_channel_detected(c: connection)
|
||||
{
|
||||
local msg = fmt("GridFTP data channel over threshold %d bytes",
|
||||
size_threshold);
|
||||
NOTICE([$note=Data_Channel, $msg=msg, $conn=c]);
|
||||
}
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
# A diff canonifier that removes all X.509 Distinguished Name subject fields
|
||||
# because that output can differ depending on installed OpenSSL version.
|
||||
|
||||
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1 }
|
||||
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1; cs_col = -1; ci_col = -1 }
|
||||
|
||||
/^#fields/ {
|
||||
for ( i = 2; i < NF; ++i )
|
||||
|
|
@ -12,6 +12,10 @@ BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1 }
|
|||
s_col = i-1;
|
||||
if ( $i == "issuer_subject" )
|
||||
i_col = i-1;
|
||||
if ( $i == "client_subject" )
|
||||
cs_col = i-1;
|
||||
if ( $i == "client_issuer_subject" )
|
||||
ci_col = i-1;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -27,6 +31,18 @@ i_col >= 0 {
|
|||
$i_col = "+";
|
||||
}
|
||||
|
||||
cs_col >= 0 {
|
||||
if ( $cs_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
$cs_col = "+";
|
||||
}
|
||||
|
||||
ci_col >= 0 {
|
||||
if ( $ci_col != "-" )
|
||||
# Mark that it's set, but ignore content.
|
||||
$ci_col = "+";
|
||||
}
|
||||
|
||||
{
|
||||
print;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue