Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Make tunnels always identifiable by UID, tunnel.log now gets populated.

Browse source 
conn.log now sets a field indicating all the parent tunnel UIDs over
which a connection operated and cross reference the UIDs found in
the tunnel.log.

Also some renaming of tunnel related types at the scripting layer.
This commit is contained in:
Jon Siwek 2012-04-26 12:29:59 -05:00
parent ad55331258
commit b8e1604ab5
22 changed files with 224 additions and 213 deletions
Download patch file Download diff file Expand all files Collapse all files

134
scripts/base/frameworks/tunnels/main.bro
View file

@ -1,53 +1,127 @@
module Tunnels;
module Tunnel;
export {
## The tunnel logging stream identifier.
redef enum Log::ID += { LOG };
## Types of interesting activity that can occur with a tunnel.
type Action: enum {
## A new tunnel (encapsulating "connection") has been seen.
DISCOVER,
## A tunnel connection has closed.
CLOSE,
## No new connections over a tunnel happened in the past day.
EXPIRE,
};
## The record type which contains column fields of the tunnel log.
type Info: record {
ts: time &log;
uid: string &log &optional;
id: conn_id &log;
action: Action &log;
tunnel_type: string &log;
user: string &log &optional;
## Time at which some tunnel activity occurred.
ts: time &log;
## The unique identifier for the tunnel, which may correspond
## to a :bro:type:`connection`'s *uid* field for non-IP-in-IP tunnels.
uid: string &log &optional;
## The tunnel "connection" 4-tuple of endpoint addresses/ports.
## For an IP tunnel, the ports will be 0.
id: conn_id &log;
## The type of activity that occurred.
action: Action &log;
## The type of tunnel.
tunnel_type: Tunnel::Type &log;
user: string &log &optional;
};
global register: function(c: connection, tunnel_type: string);
global active: table[conn_id] of Tunnels::Info = table();
## Logs all tunnels in an ecapsulation chain with action
## :bro:see:`Tunnel::DISCOVER` that aren't already in the
## :bro:id:`Tunnel::active` table and adds them if not.
global register_all: function(ecv: EncapsulatingConnVector);
## Logs a single tunnel "connection" with action
## :bro:see:`Tunnel::DISCOVER` if it's not already in the
## :bro:id:`Tunnel::active` table and adds it if not.
global register: function(ec: EncapsulatingConn);
## Logs a single tunnel "connection" with action
## :bro:see:`Tunnel::EXPIRE` and removes it from the
## :bro:id:`Tunnel::active` table.
##
## t: A table of tunnels.
##
## idx: The index of the tunnel table corresponding to the tunnel to expire.
##
## Returns: 0secs, which when this function is used as an
## :bro:attr:`&expire_func`, indicates to remove the element at
## *idx* immediately.
global expire: function(t: table[conn_id] of Info, idx: conn_id): interval;
## Removes a single tunnel from the :bro:id:`Tunnel::active` table
## and logs the closing/expiration of the tunnel.
##
## tunnel: The tunnel which has closed or expired.
##
## action: The specific reason for the tunnel ending.
global close: function(tunnel: Info, action: Action);
## Currently active tunnels. That is, tunnels for which new, encapsulated
## connections have been seen in the last day.
global active: table[conn_id] of Info = table() &synchronized &read_expire=24hrs &expire_func=expire;
}
event bro_init() &priority=5
{
Log::create_stream(Tunnels::LOG, [$columns=Info]);
Log::create_stream(Tunnel::LOG, [$columns=Info]);
}
function register(c: connection, tunnel_type: string)
function register_all(ecv: EncapsulatingConnVector)
{
local tunnel: Info;
for ( i in ecv )
register(ecv[i]);
}
function register(ec: EncapsulatingConn)
{
if ( ec$cid !in active )
{
local tunnel: Info;
tunnel$ts = network_time();
tunnel$uid = ec$uid;
tunnel$id = ec$cid;
tunnel$action = DISCOVER;
tunnel$tunnel_type = ec$tunnel_type;
active[ec$cid] = tunnel;
Log::write(LOG, tunnel);
}
}
function close(tunnel: Info, action: Action)
{
tunnel$action = action;
tunnel$ts = network_time();
tunnel$uid = c$uid;
tunnel$id = c$id;
tunnel$action = DISCOVER;
tunnel$tunnel_type = tunnel_type;
active[c$id] = tunnel;
Log::write(LOG, tunnel);
delete active[tunnel$id];
}
function expire(t: table[conn_id] of Info, idx: conn_id): interval
{
close(t[idx], EXPIRE);
return 0secs;
}
event new_connection(c: connection) &priority=5
{
if ( c?$tunnel )
register_all(c$tunnel);
}
event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5
{
if ( c?$tunnel )
register_all(c$tunnel);
register_all(e);
}
event connection_state_remove(c: connection) &priority=-5
{
if ( c$id in active )
{
local tunnel = active[c$id];
tunnel$action=CLOSE;
Log::write(LOG, tunnel);
delete active[c$id];
}
}
close(active[c$id], CLOSE);
}