Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/johanna/conn-duration-thresholds'

Browse source 
* origin/topic/johanna/conn-duration-thresholds:
  Add duration thresholding to the conn-size analyzer.
This commit is contained in:
Johanna Amann 2019-08-01 13:53:51 -07:00
commit 6fa0f4ac49
16 changed files with 324 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

35
src/analyzer/protocol/conn-size/ConnSize.cc
View file

@ -13,8 +13,9 @@ using namespace analyzer::conn_size;
ConnSize_Analyzer::ConnSize_Analyzer(Connection* c)
: Analyzer("CONNSIZE", c),
orig_bytes(), resp_bytes(), orig_pkts(), resp_pkts(),
orig_bytes_thresh(), resp_bytes_thresh(), orig_pkts_thresh(), resp_pkts_thresh()
orig_bytes_thresh(), resp_bytes_thresh(), orig_pkts_thresh(), resp_pkts_thresh(), duration_thresh()
{
start_time = c->StartTime();
}
@ -54,7 +55,7 @@ void ConnSize_Analyzer::ThresholdEvent(EventHandlerPtr f, uint64 threshold, bool
});
}
void ConnSize_Analyzer::CheckSizes(bool is_orig)
void ConnSize_Analyzer::CheckThresholds(bool is_orig)
{
if ( is_orig )
{
@ -84,6 +85,19 @@ void ConnSize_Analyzer::CheckSizes(bool is_orig)
resp_pkts_thresh = 0;
}
}
if ( duration_thresh != 0 )
{
if ( duration_thresh > ( network_time - start_time ) && conn_duration_threshold_crossed )
{
ConnectionEventFast(conn_duration_threshold_crossed, {
BuildConnVal(),
new Val(duration_thresh, TYPE_INTERVAL),
val_mgr->GetBool(is_orig),
});
duration_thresh = 0;
}
}
}
void ConnSize_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq, const IP_Hdr* ip, int caplen)
@ -101,10 +115,10 @@ void ConnSize_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
resp_pkts ++;
}
CheckSizes(is_orig);
CheckThresholds(is_orig);
}
void ConnSize_Analyzer::SetThreshold(uint64 threshold, bool bytes, bool orig)
void ConnSize_Analyzer::SetByteAndPacketThreshold(uint64 threshold, bool bytes, bool orig)
{
if ( bytes )
{
@ -122,10 +136,10 @@ void ConnSize_Analyzer::SetThreshold(uint64 threshold, bool bytes, bool orig)
}
// Check if threshold is already crossed.
CheckSizes(orig);
CheckThresholds(orig);
}
uint64_t ConnSize_Analyzer::GetThreshold(bool bytes, bool orig)
uint64_t ConnSize_Analyzer::GetByteAndPacketThreshold(bool bytes, bool orig)
{
if ( bytes )
{
@ -143,6 +157,14 @@ uint64_t ConnSize_Analyzer::GetThreshold(bool bytes, bool orig)
}
}
void ConnSize_Analyzer::SetDurationThreshold(double duration)
{
duration_thresh = duration;
// for duration thresholds, it does not matter which direction we check.
CheckThresholds(true);
}
void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val)
{
// RecordType *connection_type is decleared in NetVar.h
@ -181,4 +203,3 @@ void ConnSize_Analyzer::FlipRoles()
orig_pkts = resp_pkts;
resp_pkts = tmp;
}

12
src/analyzer/protocol/conn-size/ConnSize.h
View file

@ -21,8 +21,11 @@ public:
void UpdateConnVal(RecordVal *conn_val) override;
void FlipRoles() override;
void SetThreshold(uint64_t threshold, bool bytes, bool orig);
uint64 GetThreshold(bool bytes, bool orig);
void SetByteAndPacketThreshold(uint64_t threshold, bool bytes, bool orig);
uint64 GetByteAndPacketThreshold(bool bytes, bool orig);
void SetDurationThreshold(double duration);
double GetDurationThreshold() { return duration_thresh; };
static analyzer::Analyzer* Instantiate(Connection* conn)
{ return new ConnSize_Analyzer(conn); }
@ -30,7 +33,7 @@ public:
protected:
void DeliverPacket(int len, const u_char* data, bool is_orig,
uint64 seq, const IP_Hdr* ip, int caplen) override;
void CheckSizes(bool is_orig);
void CheckThresholds(bool is_orig);
void ThresholdEvent(EventHandlerPtr f, uint64 threshold, bool is_orig);
@ -43,6 +46,9 @@ protected:
uint64_t resp_bytes_thresh;
uint64_t orig_pkts_thresh;
uint64_t resp_pkts_thresh;
double start_time;
double duration_thresh;
};
} } // namespace analyzer::*

29
src/analyzer/protocol/conn-size/events.bif
View file

@ -1,6 +1,6 @@
## Generated for a connection that crossed a set byte threshold. Note that this
## is a low level event that should usually be avoided for user code. Use
## ConnThreshold::bytes_threshold_crossed instead.
## :zeek:see:`ConnThreshold::bytes_threshold_crossed` instead.
##
## c: the connection
##
@ -9,12 +9,13 @@
## is_orig: true if the threshold was crossed by the originator of the connection
##
## .. zeek:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_packets_threshold_crossed
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## get_current_conn_bytes_threshold get_current_conn_packets_threshold conn_duration_threshold_crossed
## set_current_conn_duration_threshold get_current_conn_duration_threshold
event conn_bytes_threshold_crossed%(c: connection, threshold: count, is_orig: bool%);
## Generated for a connection that crossed a set packet threshold. Note that this
## is a low level event that should usually be avoided for user code. Use
## ConnThreshold::bytes_threshold_crossed instead.
## :zeek:see:`ConnThreshold::packets_threshold_crossed` instead.
##
## c: the connection
##
@ -23,5 +24,25 @@ event conn_bytes_threshold_crossed%(c: connection, threshold: count, is_orig: bo
## is_orig: true if the threshold was crossed by the originator of the connection
##
## .. zeek:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_bytes_threshold_crossed
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## get_current_conn_bytes_threshold get_current_conn_packets_threshold conn_duration_threshold_crossed
## set_current_conn_duration_threshold get_current_conn_duration_threshold
event conn_packets_threshold_crossed%(c: connection, threshold: count, is_orig: bool%);
## Generated for a connection that crossed a set duration threshold. Note that this
## is a low level event that should usually be avoided for user code. Use
## :zeek:see:`ConnThreshold::duration_threshold_crossed` instead.
##
## Note that this event is not raised at the exact moment that a duration threshold is crossed; instead
## it is raised when the next packet is seen after the threshold has been crossed. On a connection that is
## idle, this can be raised significantly later.
##
## c: the connection
##
## threshold: the threshold that was set
##
## is_orig: true if the threshold was crossed by the originator of the connection
##
## .. zeek:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_bytes_threshold_crossed
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## set_current_conn_duration_threshold get_current_conn_duration_threshold
event conn_duration_threshold_crossed%(c: connection, threshold: interval, is_orig: bool%);

63
src/analyzer/protocol/conn-size/functions.bif
View file

@ -18,7 +18,7 @@ static analyzer::Analyzer* GetConnsizeAnalyzer(Val* cid)
## Sets the current byte threshold for connection sizes, overwriting any potential old
## threshold. Be aware that in nearly any case you will want to use the high level API
## instead (ConnThreshold::set_bytes_threshold).
## instead (:zeek:see:`ConnThreshold::set_bytes_threshold`).
##
## cid: The connection id.
##
@ -27,21 +27,22 @@ static analyzer::Analyzer* GetConnsizeAnalyzer(Val* cid)
## is_orig: If true, threshold is set for bytes from originator, otherwhise for bytes from responder.
##
## .. zeek:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## set_current_conn_duration_threshold get_current_conn_duration_threshold
function set_current_conn_bytes_threshold%(cid: conn_id, threshold: count, is_orig: bool%): bool
%{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a )
return val_mgr->GetBool(0);
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetThreshold(threshold, 1, is_orig);
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetByteAndPacketThreshold(threshold, 1, is_orig);
return val_mgr->GetBool(1);
%}
## Sets a threshold for connection packets, overwtiting any potential old thresholds.
## Be aware that in nearly any case you will want to use the high level API
## instead (ConnThreshold::set_packets_threshold).
## instead (:zeek:see:`ConnThreshold::set_packets_threshold`).
##
## cid: The connection id.
##
@ -50,19 +51,42 @@ function set_current_conn_bytes_threshold%(cid: conn_id, threshold: count, is_or
## is_orig: If true, threshold is set for packets from originator, otherwhise for packets from responder.
##
## .. zeek:see:: set_current_conn_bytes_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## set_current_conn_duration_threshold get_current_conn_duration_threshold
function set_current_conn_packets_threshold%(cid: conn_id, threshold: count, is_orig: bool%): bool
%{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a )
return val_mgr->GetBool(0);
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetThreshold(threshold, 0, is_orig);
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetByteAndPacketThreshold(threshold, 0, is_orig);
return val_mgr->GetBool(1);
%}
## Gets the current byte threshold size for a connection.
## Sets the current duration threshold for connection, overwriting any potential old
## threshold. Be aware that in nearly any case you will want to use the high level API
## instead (:zeek:see:`ConnThreshold::set_duration_threshold`).
##
## cid: The connection id.
##
## threshold: Threshold in seconds.
##
## .. zeek:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
## get_current_conn_bytes_threshold get_current_conn_packets_threshold
## get_current_conn_duration_threshold
function set_current_conn_duration_threshold%(cid: conn_id, threshold: interval%): bool
%{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a )
return val_mgr->GetBool(0);
static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->SetDurationThreshold(threshold);
return val_mgr->GetBool(1);
%}
# Gets the current byte threshold size for a connection.
##
## cid: The connection id.
##
@ -71,14 +95,15 @@ function set_current_conn_packets_threshold%(cid: conn_id, threshold: count, is_
## Returns: 0 if no threshold is set or the threshold in bytes
##
## .. zeek:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
## get_current_conn_packets_threshold
## get_current_conn_packets_threshold set_current_conn_duration_threshold
## get_current_conn_duration_threshold
function get_current_conn_bytes_threshold%(cid: conn_id, is_orig: bool%): count
%{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a )
return val_mgr->GetCount(0);
return val_mgr->GetCount(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetThreshold(1, is_orig));
return val_mgr->GetCount(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetByteAndPacketThreshold(1, is_orig));
%}
## Gets the current packet threshold size for a connection.
@ -90,13 +115,29 @@ function get_current_conn_bytes_threshold%(cid: conn_id, is_orig: bool%): count
## Returns: 0 if no threshold is set or the threshold in packets
##
## .. zeek:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
## get_current_conn_bytes_threshold
## get_current_conn_bytes_threshold set_current_conn_duration_threshold get_current_conn_duration_threshold
function get_current_conn_packets_threshold%(cid: conn_id, is_orig: bool%): count
%{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a )
return val_mgr->GetCount(0);
return val_mgr->GetCount(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetThreshold(0, is_orig));
return val_mgr->GetCount(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetByteAndPacketThreshold(0, is_orig));
%}
## Gets the current duration threshold size for a connection.
##
## cid: The connection id.
##
## Returns: 0 if no threshold is set or the threshold in seconds
##
## .. zeek:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
## get_current_conn_packets_threshold set_current_conn_duration_threshold
function get_current_conn_duration_threshold%(cid: conn_id%): interval
%{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a )
return new Val(0.0, TYPE_INTERVAL);
return new Val(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetDurationThreshold(), TYPE_INTERVAL);
%}