mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 04:28:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/vladg/file-analysis-exe-analyzer
Conflicts: src/types.bif
This commit is contained in:
Vlad Grigorescu
commit
b90c8cb8ec
709 changed files with 119094 additions and 88762 deletions
|
|
@ -71,11 +71,50 @@ global classification_map: table[count] of string;
|
|||
global sid_map: table[count] of string;
|
||||
global gen_map: table[count] of string;
|
||||
|
||||
global num_classification_map_reads = 0;
|
||||
global num_sid_map_reads = 0;
|
||||
global num_gen_map_reads = 0;
|
||||
global watching = F;
|
||||
|
||||
# For reading in config files.
|
||||
type OneLine: record {
|
||||
line: string;
|
||||
};
|
||||
|
||||
function mappings_initialized(): bool
|
||||
{
|
||||
return num_classification_map_reads > 0 &&
|
||||
num_sid_map_reads > 0 &&
|
||||
num_gen_map_reads > 0;
|
||||
}
|
||||
|
||||
function start_watching()
|
||||
{
|
||||
if ( watching )
|
||||
return;
|
||||
|
||||
watching = T;
|
||||
|
||||
if ( watch_dir != "" )
|
||||
{
|
||||
Dir::monitor(watch_dir, function(fname: string)
|
||||
{
|
||||
Input::add_analysis([$source=fname,
|
||||
$reader=Input::READER_BINARY,
|
||||
$mode=Input::STREAM,
|
||||
$name=fname]);
|
||||
}, 10secs);
|
||||
}
|
||||
|
||||
if ( watch_file != "" )
|
||||
{
|
||||
Input::add_analysis([$source=watch_file,
|
||||
$reader=Input::READER_BINARY,
|
||||
$mode=Input::STREAM,
|
||||
$name=watch_file]);
|
||||
}
|
||||
}
|
||||
|
||||
function create_info(ev: IDSEvent): Info
|
||||
{
|
||||
local info = Info($ts=ev$ts,
|
||||
|
|
@ -136,11 +175,33 @@ event Unified2::read_classification_line(desc: Input::EventDescription, tpe: Inp
|
|||
}
|
||||
}
|
||||
|
||||
event Input::end_of_data(name: string, source: string)
|
||||
{
|
||||
if ( name == classification_config )
|
||||
++num_classification_map_reads;
|
||||
else if ( name == sid_msg )
|
||||
++num_sid_map_reads;
|
||||
else if ( name == gen_msg )
|
||||
++num_gen_map_reads;
|
||||
else
|
||||
return;
|
||||
|
||||
if ( watching )
|
||||
return;
|
||||
|
||||
if ( mappings_initialized() )
|
||||
start_watching();
|
||||
}
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Unified2::LOG, [$columns=Info, $ev=log_unified2]);
|
||||
|
||||
if ( sid_msg != "" )
|
||||
if ( sid_msg == "" )
|
||||
{
|
||||
num_sid_map_reads = 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
Input::add_event([$source=sid_msg,
|
||||
$reader=Input::READER_RAW,
|
||||
|
|
@ -151,7 +212,11 @@ event bro_init() &priority=5
|
|||
$ev=Unified2::read_sid_msg_line]);
|
||||
}
|
||||
|
||||
if ( gen_msg != "" )
|
||||
if ( gen_msg == "" )
|
||||
{
|
||||
num_gen_map_reads = 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
Input::add_event([$source=gen_msg,
|
||||
$name=gen_msg,
|
||||
|
|
@ -162,7 +227,11 @@ event bro_init() &priority=5
|
|||
$ev=Unified2::read_gen_msg_line]);
|
||||
}
|
||||
|
||||
if ( classification_config != "" )
|
||||
if ( classification_config == "" )
|
||||
{
|
||||
num_classification_map_reads = 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
Input::add_event([$source=classification_config,
|
||||
$name=classification_config,
|
||||
|
|
@ -173,24 +242,8 @@ event bro_init() &priority=5
|
|||
$ev=Unified2::read_classification_line]);
|
||||
}
|
||||
|
||||
if ( watch_dir != "" )
|
||||
{
|
||||
Dir::monitor(watch_dir, function(fname: string)
|
||||
{
|
||||
Input::add_analysis([$source=fname,
|
||||
$reader=Input::READER_BINARY,
|
||||
$mode=Input::STREAM,
|
||||
$name=fname]);
|
||||
}, 10secs);
|
||||
}
|
||||
|
||||
if ( watch_file != "" )
|
||||
{
|
||||
Input::add_analysis([$source=watch_file,
|
||||
$reader=Input::READER_BINARY,
|
||||
$mode=Input::STREAM,
|
||||
$name=watch_file]);
|
||||
}
|
||||
if ( mappings_initialized() )
|
||||
start_watching();
|
||||
}
|
||||
|
||||
event file_new(f: fa_file)
|
||||
|
|
|
|||
|
|
@ -1,2 +1,3 @@
|
|||
@load-sigs ./general
|
||||
@load-sigs ./msoffice
|
||||
@load-sigs ./libmagic
|
||||
|
|
|
|||
|
|
@ -1,11 +1,137 @@
|
|||
# General purpose file magic signatures.
|
||||
|
||||
signature file-plaintext {
|
||||
file-magic /([[:print:][:space:]]{10})/
|
||||
file-magic /^([[:print:][:space:]]{10})/
|
||||
file-mime "text/plain", -20
|
||||
}
|
||||
|
||||
signature file-tar {
|
||||
file-magic /([[:print:]\x00]){100}(([[:digit:]\x00\x20]){8}){3}/
|
||||
file-mime "application/x-tar", 150
|
||||
file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/
|
||||
file-mime "application/x-tar", 100
|
||||
}
|
||||
|
||||
signature file-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x03\x04.{2}/
|
||||
}
|
||||
|
||||
signature file-jar {
|
||||
file-mime "application/java-archive", 100
|
||||
file-magic /^PK\x03\x04.{1,200}\x14\x00..META-INF\/MANIFEST\.MF/
|
||||
}
|
||||
|
||||
signature file-java-applet {
|
||||
file-magic /^\xca\xfe\xba\xbe...[\x2e-\x34]/
|
||||
file-mime "application/x-java-applet", 71
|
||||
}
|
||||
|
||||
# Shockwave flash
|
||||
signature file-swf {
|
||||
file-magic /^(F|C|Z)WS/
|
||||
file-mime "application/x-shockwave-flash", 60
|
||||
}
|
||||
|
||||
# Microsoft Outlook's Transport Neutral Encapsulation Format
|
||||
signature file-tnef {
|
||||
file-magic /^\x78\x9f\x3e\x22/
|
||||
file-mime "application/vnd.ms-tnef", 100
|
||||
}
|
||||
|
||||
# Mac OS X DMG files
|
||||
signature file-dmg {
|
||||
file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/
|
||||
file-mime "application/x-dmg", 100
|
||||
}
|
||||
|
||||
# Mac OS X Mach-O executable
|
||||
signature file-mach-o {
|
||||
file-magic /^[\xce\xcf]\xfa\xed\xfe/
|
||||
file-mime "application/x-mach-o-executable", 100
|
||||
}
|
||||
|
||||
# Mac OS X Universal Mach-O executable
|
||||
signature file-mach-o-universal {
|
||||
file-magic /^\xca\xfe\xba\xbe..\x00[\x01-\x14]/
|
||||
file-mime "application/x-mach-o-executable", 100
|
||||
}
|
||||
|
||||
# XAR (eXtensible ARchive) format.
|
||||
# Mac OS X uses this for the .pkg format.
|
||||
signature file-xar {
|
||||
file-magic /^xar\!/
|
||||
file-mime "application/x-xar", 100
|
||||
}
|
||||
|
||||
signature file-pkcs7 {
|
||||
file-magic /^MIME-Version:.*protocol=\"application\/pkcs7-signature\"/
|
||||
file-mime "application/pkcs7-signature", 100
|
||||
}
|
||||
|
||||
# Concatenated X.509 certificates in textual format.
|
||||
signature file-pem {
|
||||
file-magic /^-----BEGIN CERTIFICATE-----/
|
||||
file-mime "application/x-pem"
|
||||
}
|
||||
|
||||
# Java Web Start file.
|
||||
signature file-jnlp {
|
||||
file-magic /^\<jnlp\x20/
|
||||
file-mime "application/x-java-jnlp-file", 100
|
||||
}
|
||||
|
||||
signature file-ico {
|
||||
file-magic /^\x00\x00\x01\x00/
|
||||
file-mime "image/x-icon", 70
|
||||
}
|
||||
|
||||
signature file-cur {
|
||||
file-magic /^\x00\x00\x02\x00/
|
||||
file-mime "image/x-cursor", 70
|
||||
}
|
||||
|
||||
signature file-pcap {
|
||||
file-magic /^(\xa1\xb2\xc3\xd4|\xd4\xc3\xb2\xa1)/
|
||||
file-mime "application/vnd.tcpdump.pcap", 70
|
||||
}
|
||||
|
||||
signature file-pcap-ng {
|
||||
file-magic /^\x0a\x0d\x0d\x0a.{4}(\x1a\x2b\x3c\x4d|\x4d\x3c\x2b\x1a)/
|
||||
file-mime "application/vnd.tcpdump.pcap", 100
|
||||
}
|
||||
|
||||
signature file-shellscript {
|
||||
file-mime "text/x-shellscript", 250
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(ba|tc|c|z|fa|ae|k)?sh/
|
||||
}
|
||||
|
||||
signature file-perl {
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?perl/
|
||||
file-mime "text/x-perl", 60
|
||||
}
|
||||
|
||||
signature file-ruby {
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?ruby/
|
||||
file-mime "text/x-ruby", 60
|
||||
}
|
||||
|
||||
signature file-python {
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?python/
|
||||
file-mime "text/x-python", 60
|
||||
}
|
||||
|
||||
signature file-php {
|
||||
file-magic /^.*<\?php/
|
||||
file-mime "text/x-php", 40
|
||||
}
|
||||
|
||||
# Stereolithography ASCII format
|
||||
signature file-stl-ascii {
|
||||
file-magic /^solid\x20/
|
||||
file-mime "application/sla", 10
|
||||
}
|
||||
|
||||
# Sketchup model file
|
||||
signature file-skp {
|
||||
file-magic /^\xFF\xFE\xFF\x0E\x53\x00\x6B\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4D\x00\x6F\x00\x64\x00\x65\x00\x6C\x00/
|
||||
file-mime "application/skp", 100
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,42 +7,18 @@
|
|||
# The instrumented version of the `file` command used to generate these
|
||||
# is located at: https://github.com/jsiwek/file/tree/bro-signatures.
|
||||
|
||||
# >2080 string,=Foglio di lavoro Microsoft Exce (len=31), ["%s"], swap_endian=0
|
||||
signature file-magic-auto0 {
|
||||
file-mime "application/vnd.ms-excel", 340
|
||||
file-magic /(.{2080})(Foglio di lavoro Microsoft Exce)/
|
||||
}
|
||||
|
||||
# >2 string,=---BEGIN PGP PUBLIC KEY BLOCK- (len=30), ["PGP public key block"], swap_endian=0
|
||||
signature file-magic-auto1 {
|
||||
file-mime "application/pgp-keys", 330
|
||||
file-magic /(.{2})(\x2d\x2d\x2dBEGIN PGP PUBLIC KEY BLOCK\x2d)/
|
||||
}
|
||||
|
||||
# >2080 string,=Microsoft Excel 5.0 Worksheet (len=29), ["%s"], swap_endian=0
|
||||
signature file-magic-auto2 {
|
||||
file-mime "application/vnd.ms-excel", 320
|
||||
file-magic /(.{2080})(Microsoft Excel 5\x2e0 Worksheet)/
|
||||
}
|
||||
|
||||
# >11 string,=must be converted with BinHex (len=29), ["BinHex binary text"], swap_endian=0
|
||||
signature file-magic-auto3 {
|
||||
file-mime "application/mac-binhex40", 320
|
||||
file-magic /(.{11})(must be converted with BinHex)/
|
||||
}
|
||||
|
||||
# >2080 string,=Microsoft Word 6.0 Document (len=27), ["%s"], swap_endian=0
|
||||
signature file-magic-auto4 {
|
||||
file-mime "application/msword", 300
|
||||
file-magic /(.{2080})(Microsoft Word 6\x2e0 Document)/
|
||||
}
|
||||
|
||||
# >2080 string,=Documento Microsoft Word 6 (len=26), ["Spanish Microsoft Word 6 document data"], swap_endian=0
|
||||
signature file-magic-auto5 {
|
||||
file-mime "application/msword", 290
|
||||
file-magic /(.{2080})(Documento Microsoft Word 6)/
|
||||
}
|
||||
|
||||
# >0 string,=-----BEGIN PGP SIGNATURE- (len=25), ["PGP signature"], swap_endian=0
|
||||
signature file-magic-auto6 {
|
||||
file-mime "application/pgp-signature", 280
|
||||
|
|
@ -92,36 +68,6 @@ signature file-magic-auto13 {
|
|||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fgawk)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/bin/bash (len=22), ["Bourne-Again shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto14 {
|
||||
file-mime "text/x-shellscript", 250
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fbash)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/bin/tcsh (len=22), ["Tenex C shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto15 {
|
||||
file-mime "text/x-shellscript", 250
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2ftcsh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/bin/zsh (len=21), ["Paul Falstad's zsh script text executable"], swap_endian=0
|
||||
signature file-magic-auto16 {
|
||||
file-mime "text/x-shellscript", 240
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fzsh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/bin/ash (len=21), ["Neil Brown's ash script text executable"], swap_endian=0
|
||||
signature file-magic-auto17 {
|
||||
file-mime "text/x-shellscript", 240
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fash)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/bin/ae (len=20), ["Neil Brown's ae script text executable"], swap_endian=0
|
||||
signature file-magic-auto18 {
|
||||
file-mime "text/x-shellscript", 230
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fae)/
|
||||
}
|
||||
|
||||
# >0 string,=# PaCkAgE DaTaStReAm (len=20), ["pkg Datastream (SVR4)"], swap_endian=0
|
||||
signature file-magic-auto19 {
|
||||
file-mime "application/x-svr4-package", 230
|
||||
|
|
@ -140,30 +86,12 @@ signature file-magic-auto21 {
|
|||
file-magic /(\x5bKDE Desktop Entry\x5d)/
|
||||
}
|
||||
|
||||
# >512 string,=R\000o\000o\000t\000 \000E\000n\000t\000r\000y (len=19), ["Microsoft Word Document"], swap_endian=0
|
||||
signature file-magic-auto22 {
|
||||
file-mime "application/msword", 220
|
||||
file-magic /(.{512})(R\x00o\x00o\x00t\x00 \x00E\x00n\x00t\x00r\x00y)/
|
||||
}
|
||||
|
||||
# >0 string,=!<arch>\n__________E (len=19), ["MIPS archive"], swap_endian=0
|
||||
signature file-magic-auto23 {
|
||||
file-mime "application/x-archive", 220
|
||||
file-magic /(\x21\x3carch\x3e\x0a\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5fE)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/tcsh (len=18), ["Tenex C shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto24 {
|
||||
file-mime "text/x-shellscript", 210
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2ftcsh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/local/bash (len=18), ["Bourne-Again shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto25 {
|
||||
file-mime "text/x-shellscript", 210
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbash)/
|
||||
}
|
||||
|
||||
# >0 string/t,=# KDE Config File (len=17), ["KDE config file"], swap_endian=0
|
||||
signature file-magic-auto26 {
|
||||
file-mime "application/x-kdelnk", 200
|
||||
|
|
@ -189,12 +117,6 @@ signature file-magic-auto29 {
|
|||
file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fnawk)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/bin/tcsh (len=16), ["Tenex C shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto30 {
|
||||
file-mime "text/x-shellscript", 190
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2ftcsh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/bin/gawk (len=16), ["GNU awk script text executable"], swap_endian=0
|
||||
signature file-magic-auto31 {
|
||||
file-mime "text/x-gawk", 190
|
||||
|
|
@ -207,12 +129,6 @@ signature file-magic-auto32 {
|
|||
file-magic /(.{369})(MICROSOFT PIFEX\x00)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/bin/bash (len=16), ["Bourne-Again shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto33 {
|
||||
file-mime "text/x-shellscript", 190
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fbash)/
|
||||
}
|
||||
|
||||
# >0 string/w,=#VRML V1.0 ascii (len=16), ["VRML 1 file"], swap_endian=0
|
||||
signature file-magic-auto34 {
|
||||
file-mime "model/vrml", 190
|
||||
|
|
@ -334,12 +250,6 @@ signature file-magic-auto51 {
|
|||
file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fawk)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /usr/bin/zsh (len=15), ["Paul Falstad's zsh script text executable"], swap_endian=0
|
||||
signature file-magic-auto52 {
|
||||
file-mime "text/x-shellscript", 180
|
||||
file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fzsh)/
|
||||
}
|
||||
|
||||
# >0 string,=MAS_UTrack_V00 (len=14), [""], swap_endian=0
|
||||
# >>14 string,>/0 (len=2), ["ultratracker V1.%.1s module sound data"], swap_endian=0
|
||||
signature file-magic-auto53 {
|
||||
|
|
@ -457,12 +367,6 @@ signature file-magic-auto70 {
|
|||
file-magic /(\x3cmap ?version)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/tcsh (len=12), ["Tenex C shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto71 {
|
||||
file-mime "text/x-shellscript", 150
|
||||
file-magic /(\x23\x21 ?\x2fbin\x2ftcsh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/nawk (len=12), ["new awk script text executable"], swap_endian=0
|
||||
signature file-magic-auto72 {
|
||||
file-mime "text/x-nawk", 150
|
||||
|
|
@ -475,12 +379,6 @@ signature file-magic-auto73 {
|
|||
file-magic /(\x23\x21 ?\x2fbin\x2fgawk)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/bash (len=12), ["Bourne-Again shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto74 {
|
||||
file-mime "text/x-shellscript", 150
|
||||
file-magic /(\x23\x21 ?\x2fbin\x2fbash)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/awk (len=11), ["awk script text executable"], swap_endian=0
|
||||
signature file-magic-auto75 {
|
||||
file-mime "text/x-awk", 140
|
||||
|
|
@ -505,24 +403,6 @@ signature file-magic-auto78 {
|
|||
file-magic /(d8\x3aannounce)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/csh (len=11), ["C shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto79 {
|
||||
file-mime "text/x-shellscript", 140
|
||||
file-magic /(\x23\x21 ?\x2fbin\x2fcsh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/ksh (len=11), ["Korn shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto80 {
|
||||
file-mime "text/x-shellscript", 140
|
||||
file-magic /(\x23\x21 ?\x2fbin\x2fksh)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/zsh (len=11), ["Paul Falstad's zsh script text executable"], swap_endian=0
|
||||
signature file-magic-auto81 {
|
||||
file-mime "text/x-shellscript", 140
|
||||
file-magic /(\x23\x21 ?\x2fbin\x2fzsh)/
|
||||
}
|
||||
|
||||
# >0 string/c,=BEGIN:VCARD (len=11), ["vCard visiting card"], swap_endian=0
|
||||
signature file-magic-auto82 {
|
||||
file-mime "text/x-vcard", 140
|
||||
|
|
@ -545,12 +425,6 @@ signature file-magic-auto84 {
|
|||
file-magic /(Forward to)/
|
||||
}
|
||||
|
||||
# >0 string/wt,=#! /bin/sh (len=10), ["POSIX shell script text executable"], swap_endian=0
|
||||
signature file-magic-auto85 {
|
||||
file-mime "text/x-shellscript", 130
|
||||
file-magic /(\x23\x21 ?\x2fbin\x2fsh)/
|
||||
}
|
||||
|
||||
# >0 string,=II*\000\020\000\000\000CR (len=10), ["Canon CR2 raw image data"], swap_endian=0
|
||||
signature file-magic-auto86 {
|
||||
file-mime "image/x-canon-cr2", 130
|
||||
|
|
@ -585,12 +459,6 @@ signature file-magic-auto90 {
|
|||
file-magic /(\x3cBookFile)/
|
||||
}
|
||||
|
||||
# >2112 string,=MSWordDoc (len=9), ["Microsoft Word document data"], swap_endian=0
|
||||
signature file-magic-auto91 {
|
||||
file-mime "application/msword", 120
|
||||
file-magic /(.{2112})(MSWordDoc)/
|
||||
}
|
||||
|
||||
# >0 string/t,=N#! rnews (len=9), ["mailed, batched news text"], swap_endian=0
|
||||
signature file-magic-auto92 {
|
||||
file-mime "message/rfc822", 120
|
||||
|
|
@ -656,12 +524,6 @@ signature file-magic-auto100 {
|
|||
file-magic /(MSCF\x00\x00\x00\x00)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\320\317\021\340\241\261\032\341 (len=8), ["Microsoft Office Document"], swap_endian=0
|
||||
signature file-magic-auto101 {
|
||||
file-mime "application/msword", 110
|
||||
file-magic /(\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1)/
|
||||
}
|
||||
|
||||
# >21 string/c,=!SCREAM! (len=8), ["Screamtracker 2 module sound data"], swap_endian=0
|
||||
signature file-magic-auto102 {
|
||||
file-mime "audio/x-mod", 110
|
||||
|
|
@ -754,10 +616,10 @@ signature file-magic-auto116 {
|
|||
}
|
||||
|
||||
# >257 string,=ustar \000 (len=8), ["GNU tar archive"], swap_endian=0
|
||||
signature file-magic-auto117 {
|
||||
file-mime "application/x-tar", 110
|
||||
file-magic /(.{257})(ustar \x00)/
|
||||
}
|
||||
#signature file-magic-auto117 {
|
||||
# file-mime "application/x-tar", 110
|
||||
# file-magic /(.{257})(ustar \x00)/
|
||||
#}
|
||||
|
||||
# >0 string,=<MIFFile (len=8), ["FrameMaker MIF (ASCII) file"], swap_endian=0
|
||||
signature file-magic-auto118 {
|
||||
|
|
@ -771,12 +633,6 @@ signature file-magic-auto119 {
|
|||
file-magic /(PK\x07\x08PK\x03\x04)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\t\004\006\000\000\000\020\000 (len=8), ["Microsoft Excel Worksheet"], swap_endian=0
|
||||
signature file-magic-auto120 {
|
||||
file-mime "application/vnd.ms-excel", 110
|
||||
file-magic /(\x09\x04\x06\x00\x00\x00\x10\x00)/
|
||||
}
|
||||
|
||||
# >0 string/b,=WordPro\000 (len=8), ["Lotus WordPro"], swap_endian=0
|
||||
signature file-magic-auto121 {
|
||||
file-mime "application/vnd.lotus-wordpro", 110
|
||||
|
|
@ -844,10 +700,10 @@ signature file-magic-auto130 {
|
|||
}
|
||||
|
||||
# >257 string,=ustar\000 (len=6), ["POSIX tar archive"], swap_endian=0
|
||||
signature file-magic-auto131 {
|
||||
file-mime "application/x-tar", 90
|
||||
file-magic /(.{257})(ustar\x00)/
|
||||
}
|
||||
#signature file-magic-auto131 {
|
||||
# file-mime "application/x-tar", 90
|
||||
# file-magic /(.{257})(ustar\x00)/
|
||||
#}
|
||||
|
||||
# >0 string,=AC1.40 (len=6), ["DWG AutoDesk AutoCAD Release 1.40"], swap_endian=0
|
||||
signature file-magic-auto132 {
|
||||
|
|
@ -994,12 +850,6 @@ signature file-magic-auto155 {
|
|||
file-magic /(\x23 xmcd)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\333\245-\000\000\000 (len=6), ["Microsoft Office Document"], swap_endian=0
|
||||
signature file-magic-auto156 {
|
||||
file-mime "application/msword", 90
|
||||
file-magic /(\xdb\xa5\x2d\x00\x00\x00)/
|
||||
}
|
||||
|
||||
# >2 string,=MMXPR3 (len=6), ["Motorola Quark Express Document (English)"], swap_endian=0
|
||||
signature file-magic-auto157 {
|
||||
file-mime "application/x-quark-xpress-3", 90
|
||||
|
|
@ -1046,36 +896,6 @@ signature file-magic-auto162 {
|
|||
file-magic /(\x3c\x3fxml)(.{15})(.*)( xmlns\x3d)(['"]http:\x2f\x2fwww.opengis.net\x2fkml)/
|
||||
}
|
||||
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>30 regex,=[Content_Types].xml|_rels/.rels (len=31), [""], swap_endian=0
|
||||
# >>>18 (lelong,+49), search/2000,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>>>&26 search/1000,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>>>>&26 string,=word/ (len=5), ["Microsoft Word 2007+"], swap_endian=0
|
||||
signature file-magic-auto163 {
|
||||
file-mime "application/vnd.openxmlformats-officedocument.wordprocessingml.document", 80
|
||||
file-magic /(PK\x03\x04)(.{26})(\[Content_Types\].xml|_rels\x2f.rels)(.*)(PK\x03\x04)(.{26})(.*)(PK\x03\x04)(.{26})(word\x2f)/
|
||||
}
|
||||
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>30 regex,=[Content_Types].xml|_rels/.rels (len=31), [""], swap_endian=0
|
||||
# >>>18 (lelong,+49), search/2000,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>>>&26 search/1000,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>>>>&26 string,=ppt/ (len=4), ["Microsoft PowerPoint 2007+"], swap_endian=0
|
||||
signature file-magic-auto164 {
|
||||
file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 70
|
||||
file-magic /(PK\x03\x04)(.{26})(\[Content_Types\].xml|_rels\x2f.rels)(.*)(PK\x03\x04)(.{26})(.*)(PK\x03\x04)(.{26})(ppt\x2f)/
|
||||
}
|
||||
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>30 regex,=[Content_Types].xml|_rels/.rels (len=31), [""], swap_endian=0
|
||||
# >>>18 (lelong,+49), search/2000,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>>>&26 search/1000,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>>>>&26 string,=xl/ (len=3), ["Microsoft Excel 2007+"], swap_endian=0
|
||||
signature file-magic-auto165 {
|
||||
file-mime "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", 60
|
||||
file-magic /(PK\x03\x04)(.{26})(\[Content_Types\].xml|_rels\x2f.rels)(.*)(PK\x03\x04)(.{26})(.*)(PK\x03\x04)(.{26})(xl\x2f)/
|
||||
}
|
||||
|
||||
# >60 string,=RINEX (len=5), [""], swap_endian=0
|
||||
# >>80 search/256,=XXRINEXB (len=8), ["RINEX Data, GEO SBAS Broadcast"], swap_endian=0
|
||||
# >>>5 string,x, [", version %6.6s"], swap_endian=0
|
||||
|
|
@ -1229,30 +1049,12 @@ signature file-magic-auto187 {
|
|||
file-magic /(\x00\x01\x00\x00\x00)/
|
||||
}
|
||||
|
||||
# >0 string/b,=PO^Q` (len=5), ["Microsoft Word 6.0 Document"], swap_endian=0
|
||||
signature file-magic-auto188 {
|
||||
file-mime "application/msword", 80
|
||||
file-magic /(PO\x5eQ\x60)/
|
||||
}
|
||||
|
||||
# >0 string,=%PDF- (len=5), ["PDF document"], swap_endian=0
|
||||
signature file-magic-auto189 {
|
||||
file-mime "application/pdf", 80
|
||||
file-magic /(\x25PDF\x2d)/
|
||||
}
|
||||
|
||||
# >2114 string,=Biff5 (len=5), ["Microsoft Excel 5.0 Worksheet"], swap_endian=0
|
||||
signature file-magic-auto190 {
|
||||
file-mime "application/vnd.ms-excel", 80
|
||||
file-magic /(.{2114})(Biff5)/
|
||||
}
|
||||
|
||||
# >2121 string,=Biff5 (len=5), ["Microsoft Excel 5.0 Worksheet"], swap_endian=0
|
||||
signature file-magic-auto191 {
|
||||
file-mime "application/vnd.ms-excel", 80
|
||||
file-magic /(.{2121})(Biff5)/
|
||||
}
|
||||
|
||||
# >0 string/t,=Path: (len=5), ["news text"], swap_endian=0
|
||||
signature file-magic-auto192 {
|
||||
file-mime "message/news", 80
|
||||
|
|
@ -1383,12 +1185,6 @@ signature file-magic-auto211 {
|
|||
file-magic /(\x00\x00\x00\x01)([\x07\x27\x47\x67\x87\xa7\xc7\xe7])/
|
||||
}
|
||||
|
||||
# >0 belong&,=-889275714 (0xcafebabe), [""], swap_endian=0
|
||||
signature file-magic-auto212 {
|
||||
file-mime "application/x-java-applet", 71
|
||||
file-magic /(\xca\xfe\xba\xbe)/
|
||||
}
|
||||
|
||||
# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0
|
||||
# >>3 byte&,=0xba, ["MPEG sequence"], swap_endian=0
|
||||
signature file-magic-auto213 {
|
||||
|
|
@ -1706,46 +1502,6 @@ signature file-magic-auto245 {
|
|||
file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(epub\x2bzip)/
|
||||
}
|
||||
|
||||
# Seems redundant with other zip signature below.
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0
|
||||
# >>>50 string,!epub+zip (len=8), [""], swap_endian=0
|
||||
# >>>>50 string,!vnd.oasis.opendocument. (len=23), [""], swap_endian=0
|
||||
# >>>>>50 string,!vnd.sun.xml. (len=12), [""], swap_endian=0
|
||||
# >>>>>>50 string,!vnd.kde. (len=8), [""], swap_endian=0
|
||||
# >>>>>>>38 regex,=[!-OQ-~]+ (len=9), ["Zip data (MIME type "%s"?)"], swap_endian=0
|
||||
#signature file-magic-auto246 {
|
||||
# file-mime "application/zip", 39
|
||||
# file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)/
|
||||
#}
|
||||
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>26 string,=\b\000\000\000mimetype (len=12), [""], swap_endian=0
|
||||
# >>>38 string,!application/ (len=12), [""], swap_endian=0
|
||||
# >>>>38 regex,=[!-OQ-~]+ (len=9), ["Zip data (MIME type "%s"?)"], swap_endian=0
|
||||
signature file-magic-auto247 {
|
||||
file-mime "application/zip", 39
|
||||
file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetype)/
|
||||
}
|
||||
|
||||
# The indirect offset makes this difficult to convert.
|
||||
# The (.*) may be too generous.
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>26 (leshort,+30), leshort&,=-13570 (0xcafe), ["Java archive data (JAR)"], swap_endian=0
|
||||
signature file-magic-auto248 {
|
||||
file-mime "application/java-archive", 50
|
||||
file-magic /(PK\x03\x04)(.*)(\xfe\xca)/
|
||||
}
|
||||
|
||||
# The indeirect offset and string inequality make this difficult to convert.
|
||||
# >0 string,=PK\003\004 (len=4), [""], swap_endian=0
|
||||
# >>26 (leshort,+30), leshort&,!-13570 (0xcafe), [""], swap_endian=0
|
||||
# >>>26 string,!\b\000\000\000mimetype (len=12), ["Zip archive data"], swap_endian=0
|
||||
signature file-magic-auto249 {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /(PK\x03\x04)(.{2})/
|
||||
}
|
||||
|
||||
# >0 belong&,=442 (0x000001ba), [""], swap_endian=0
|
||||
# >>4 byte&,&0x40, [""], swap_endian=0
|
||||
signature file-magic-auto250 {
|
||||
|
|
@ -2065,18 +1821,6 @@ signature file-magic-auto299 {
|
|||
file-magic /(PDN3)/
|
||||
}
|
||||
|
||||
# >0 ulelong&,=2712847316 (0xa1b2c3d4), ["tcpdump capture file (little-endian)"], swap_endian=0
|
||||
signature file-magic-auto300 {
|
||||
file-mime "application/vnd.tcpdump.pcap", 70
|
||||
file-magic /(\xd4\xc3\xb2\xa1)/
|
||||
}
|
||||
|
||||
# >0 ubelong&,=2712847316 (0xa1b2c3d4), ["tcpdump capture file (big-endian)"], swap_endian=0
|
||||
signature file-magic-auto301 {
|
||||
file-mime "application/vnd.tcpdump.pcap", 70
|
||||
file-magic /(\xa1\xb2\xc3\xd4)/
|
||||
}
|
||||
|
||||
# >0 belong&,=-17957139 (0xfeedfeed), ["Java KeyStore"], swap_endian=0
|
||||
signature file-magic-auto302 {
|
||||
file-mime "application/x-java-keystore", 70
|
||||
|
|
@ -2297,12 +2041,6 @@ signature file-magic-auto335 {
|
|||
file-magic /(SIT\x21)/
|
||||
}
|
||||
|
||||
# >0 lelong&,=574529400 (0x223e9f78), ["Transport Neutral Encapsulation Format"], swap_endian=0
|
||||
signature file-magic-auto336 {
|
||||
file-mime "application/vnd.ms-tnef", 70
|
||||
file-magic /(\x78\x9f\x3e\x22)/
|
||||
}
|
||||
|
||||
# >0 string,=<ar> (len=4), ["System V Release 1 ar archive"], swap_endian=0
|
||||
signature file-magic-auto337 {
|
||||
file-mime "application/x-archive", 70
|
||||
|
|
@ -2433,48 +2171,6 @@ signature file-magic-auto357 {
|
|||
file-magic /(RIFF)(.{4})(AVI )/
|
||||
}
|
||||
|
||||
# >0 belong&,=834535424 (0x31be0000), ["Microsoft Word Document"], swap_endian=0
|
||||
signature file-magic-auto358 {
|
||||
file-mime "application/msword", 70
|
||||
file-magic /(\x31\xbe\x00\x00)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\3767\000# (len=4), ["Microsoft Office Document"], swap_endian=0
|
||||
signature file-magic-auto359 {
|
||||
file-mime "application/msword", 70
|
||||
file-magic /(\xfe7\x00\x23)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\333\245-\000 (len=4), ["Microsoft WinWord 2.0 Document"], swap_endian=0
|
||||
signature file-magic-auto360 {
|
||||
file-mime "application/msword", 70
|
||||
file-magic /(\xdb\xa5\x2d\x00)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\333\245-\000 (len=4), ["Microsoft WinWord 2.0 Document"], swap_endian=0
|
||||
signature file-magic-auto361 {
|
||||
file-mime "application/msword", 70
|
||||
file-magic /(\xdb\xa5\x2d\x00)/
|
||||
}
|
||||
|
||||
# >0 belong&,=6656 (0x00001a00), ["Lotus 1-2-3"], swap_endian=0
|
||||
signature file-magic-auto362 {
|
||||
file-mime "application/x-123", 70
|
||||
file-magic /(\x00\x00\x1a\x00)/
|
||||
}
|
||||
|
||||
# >0 belong&,=512 (0x00000200), ["Lotus 1-2-3"], swap_endian=0
|
||||
signature file-magic-auto363 {
|
||||
file-mime "application/x-123", 70
|
||||
file-magic /(\x00\x00\x02\x00)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\000\000\001\000 (len=4), ["MS Windows icon resource"], swap_endian=0
|
||||
signature file-magic-auto364 {
|
||||
file-mime "image/x-icon", 70
|
||||
file-magic /(\x00\x00\x01\x00)/
|
||||
}
|
||||
|
||||
# >0 lelong&,=268435536 (0x10000050), ["Psion Series 5"], swap_endian=0
|
||||
# >>4 lelong&,=268435565 (0x1000006d), ["database"], swap_endian=0
|
||||
# >>>8 lelong&,=268435588 (0x10000084), ["Agenda file"], swap_endian=0
|
||||
|
|
@ -2737,12 +2433,6 @@ signature file-magic-auto403 {
|
|||
file-magic /(SBI)/
|
||||
}
|
||||
|
||||
# >0 string/b,=\224\246. (len=3), ["Microsoft Word Document"], swap_endian=0
|
||||
signature file-magic-auto404 {
|
||||
file-mime "application/msword", 60
|
||||
file-magic /(\x94\xa6\x2e)/
|
||||
}
|
||||
|
||||
# >0 string,=\004%! (len=3), ["PostScript document text"], swap_endian=0
|
||||
signature file-magic-auto405 {
|
||||
file-mime "application/postscript", 60
|
||||
|
|
@ -2763,30 +2453,11 @@ signature file-magic-auto407 {
|
|||
file-magic /(.*)([ \x09]*(class|module)[ \x09][A-Z])((modul|includ)e [A-Z]|def [a-z])(^[ \x09]*end([ \x09]*[;#].*)?$)/
|
||||
}
|
||||
|
||||
# >512 string/b,=\354\245\301 (len=3), ["Microsoft Word Document"], swap_endian=0
|
||||
signature file-magic-auto408 {
|
||||
file-mime "application/msword", 60
|
||||
file-magic /(.{512})(\xec\xa5\xc1)/
|
||||
}
|
||||
|
||||
# >0 string,=FWS (len=3), ["Macromedia Flash data,"], swap_endian=0
|
||||
# >>3 byte&,x, ["version %d"], swap_endian=0
|
||||
signature file-magic-auto409 {
|
||||
file-mime "application/x-shockwave-flash", 1
|
||||
file-magic /(FWS)(.{1})/
|
||||
}
|
||||
|
||||
# >0 string,=CWS (len=3), ["Macromedia Flash data (compressed),"], swap_endian=0
|
||||
signature file-magic-auto410 {
|
||||
file-mime "application/x-shockwave-flash", 60
|
||||
file-magic /(CWS)/
|
||||
}
|
||||
|
||||
# >0 regex/20,=^\.[A-Za-z0-9][A-Za-z0-9][ \t] (len=29), ["troff or preprocessor input text"], swap_endian=0
|
||||
signature file-magic-auto411 {
|
||||
file-mime "text/troff", 59
|
||||
file-magic /(^\.[A-Za-z0-9][A-Za-z0-9][ \x09])/
|
||||
}
|
||||
#signature file-magic-auto411 {
|
||||
# file-mime "text/troff", 59
|
||||
# file-magic /(^\.[A-Za-z0-9][A-Za-z0-9][ \x09])/
|
||||
#}
|
||||
|
||||
# >0 search/4096,=\documentclass (len=14), ["LaTeX 2e document text"], swap_endian=0
|
||||
signature file-magic-auto412 {
|
||||
|
|
@ -2819,10 +2490,10 @@ signature file-magic-auto416 {
|
|||
}
|
||||
|
||||
# >0 regex/20,=^\.[A-Za-z0-9][A-Za-z0-9]$ (len=26), ["troff or preprocessor input text"], swap_endian=0
|
||||
signature file-magic-auto417 {
|
||||
file-mime "text/troff", 56
|
||||
file-magic /(^\.[A-Za-z0-9][A-Za-z0-9]$)/
|
||||
}
|
||||
#signature file-magic-auto417 {
|
||||
# file-mime "text/troff", 56
|
||||
# file-magic /(^\.[A-Za-z0-9][A-Za-z0-9]$)/
|
||||
#}
|
||||
|
||||
# >0 search/w/1,=#! /usr/bin/php (len=15), ["PHP script text executable"], swap_endian=0
|
||||
signature file-magic-auto418 {
|
||||
|
|
@ -2842,30 +2513,12 @@ signature file-magic-auto420 {
|
|||
file-magic /(.*)(eval \x22exec \x2fusr\x2fbin\x2fperl)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#! /usr/local/bin/python (len=24), ["Python script text executable"], swap_endian=0
|
||||
signature file-magic-auto421 {
|
||||
file-mime "text/x-python", 54
|
||||
file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fpython)/
|
||||
}
|
||||
|
||||
# >0 search/1,=Common subdirectories: (len=23), ["diff output text"], swap_endian=0
|
||||
signature file-magic-auto422 {
|
||||
file-mime "text/x-diff", 53
|
||||
file-magic /(.*)(Common subdirectories\x3a )/
|
||||
}
|
||||
|
||||
# >0 search/1,=#! /usr/bin/env python (len=22), ["Python script text executable"], swap_endian=0
|
||||
signature file-magic-auto423 {
|
||||
file-mime "text/x-python", 52
|
||||
file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv python)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#! /usr/local/bin/ruby (len=22), ["Ruby script text executable"], swap_endian=0
|
||||
signature file-magic-auto424 {
|
||||
file-mime "text/x-ruby", 52
|
||||
file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fruby)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#! /usr/local/bin/wish (len=22), ["Tcl/Tk script text executable"], swap_endian=0
|
||||
signature file-magic-auto425 {
|
||||
file-mime "text/x-tcl", 52
|
||||
|
|
@ -2884,12 +2537,6 @@ signature file-magic-auto427 {
|
|||
file-magic /(\xff\xd8)/
|
||||
}
|
||||
|
||||
# >0 search/1,=#!/usr/bin/env python (len=21), ["Python script text executable"], swap_endian=0
|
||||
signature file-magic-auto428 {
|
||||
file-mime "text/x-python", 51
|
||||
file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv python)/
|
||||
}
|
||||
|
||||
# >0 search/1,=#!/usr/bin/env nodejs (len=21), ["Node.js script text executable"], swap_endian=0
|
||||
signature file-magic-auto429 {
|
||||
file-mime "application/javascript", 51
|
||||
|
|
@ -3202,12 +2849,6 @@ signature file-magic-auto474 {
|
|||
file-magic /(\x25\x21)/
|
||||
}
|
||||
|
||||
# >0 search/1,=#! /usr/bin/env ruby (len=20), ["Ruby script text executable"], swap_endian=0
|
||||
signature file-magic-auto475 {
|
||||
file-mime "text/x-ruby", 50
|
||||
file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv ruby)/
|
||||
}
|
||||
|
||||
# >0 regex/1,=(^[0-9]{5})[acdn][w] (len=20), ["MARC21 Classification"], swap_endian=0
|
||||
signature file-magic-auto476 {
|
||||
file-mime "application/marc", 50
|
||||
|
|
@ -3241,10 +2882,10 @@ signature file-magic-auto480 {
|
|||
}
|
||||
|
||||
# >0 string,=\n( (len=2), ["Emacs v18 byte-compiled Lisp data"], swap_endian=0
|
||||
signature file-magic-auto481 {
|
||||
file-mime "application/x-elc", 50
|
||||
file-magic /(\x0a\x28)/
|
||||
}
|
||||
#signature file-magic-auto481 {
|
||||
# file-mime "application/x-elc", 50
|
||||
# file-magic /(\x0a\x28)/
|
||||
#}
|
||||
|
||||
# >0 string,=\021\t (len=2), ["Award BIOS Logo, 136 x 126"], swap_endian=0
|
||||
signature file-magic-auto482 {
|
||||
|
|
@ -3318,17 +2959,17 @@ signature file-magic-auto493 {
|
|||
file-magic /(\xf7\x02)/
|
||||
}
|
||||
|
||||
# >2 string,=\000\021 (len=2), ["TeX font metric data"], swap_endian=0
|
||||
signature file-magic-auto494 {
|
||||
file-mime "application/x-tex-tfm", 50
|
||||
file-magic /(.{2})(\x00\x11)/
|
||||
}
|
||||
|
||||
# >2 string,=\000\022 (len=2), ["TeX font metric data"], swap_endian=0
|
||||
signature file-magic-auto495 {
|
||||
file-mime "application/x-tex-tfm", 50
|
||||
file-magic /(.{2})(\x00\x12)/
|
||||
}
|
||||
## >2 string,=\000\021 (len=2), ["TeX font metric data"], swap_endian=0
|
||||
#signature file-magic-auto494 {
|
||||
# file-mime "application/x-tex-tfm", 50
|
||||
# file-magic /(.{2})(\x00\x11)/
|
||||
#}
|
||||
#
|
||||
## >2 string,=\000\022 (len=2), ["TeX font metric data"], swap_endian=0
|
||||
#signature file-magic-auto495 {
|
||||
# file-mime "application/x-tex-tfm", 50
|
||||
# file-magic /(.{2})(\x00\x12)/
|
||||
#}
|
||||
|
||||
# >0 beshort&,=-31486 (0x8502), ["GPG encrypted data"], swap_endian=0
|
||||
signature file-magic-auto496 {
|
||||
|
|
@ -3483,12 +3124,6 @@ signature file-magic-auto514 {
|
|||
file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv lua)/
|
||||
}
|
||||
|
||||
# >0 search/1,=#!/usr/bin/env ruby (len=19), ["Ruby script text executable"], swap_endian=0
|
||||
signature file-magic-auto515 {
|
||||
file-mime "text/x-ruby", 49
|
||||
file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv ruby)/
|
||||
}
|
||||
|
||||
# >0 search/1,=#! /usr/bin/env tcl (len=19), ["Tcl script text executable"], swap_endian=0
|
||||
signature file-magic-auto516 {
|
||||
file-mime "text/x-tcl", 49
|
||||
|
|
@ -3506,12 +3141,6 @@ signature file-magic-auto519 {
|
|||
file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv lua)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#! /usr/bin/python (len=18), ["Python script text executable"], swap_endian=0
|
||||
signature file-magic-auto520 {
|
||||
file-mime "text/x-python", 48
|
||||
file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fpython)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#!/usr/bin/nodejs (len=17), ["Node.js script text executable"], swap_endian=0
|
||||
signature file-magic-auto521 {
|
||||
file-mime "application/javascript", 47
|
||||
|
|
@ -3519,10 +3148,10 @@ signature file-magic-auto521 {
|
|||
}
|
||||
|
||||
# >0 regex,=^class[ \t\n]+ (len=12), ["C++ source text"], swap_endian=0
|
||||
signature file-magic-auto522 {
|
||||
file-mime "text/x-c++", 47
|
||||
file-magic /(.*)(class[ \x09\x0a]+[[:alnum:]_]+)(.*)(\x7b)(.*)(public:)/
|
||||
}
|
||||
#signature file-magic-auto522 {
|
||||
# file-mime "text/x-c++", 47
|
||||
# file-magic /(.*)(class[ \x09\x0a]+[[:alnum:]_]+)(.*)(\x7b)(.*)(public:)/
|
||||
#}
|
||||
|
||||
# >0 search/1,=This is Info file (len=17), ["GNU Info text"], swap_endian=0
|
||||
signature file-magic-auto528 {
|
||||
|
|
@ -3671,12 +3300,6 @@ signature file-magic-auto545 {
|
|||
file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fwish)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#! /usr/bin/ruby (len=16), ["Ruby script text executable"], swap_endian=0
|
||||
signature file-magic-auto546 {
|
||||
file-mime "text/x-ruby", 46
|
||||
file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fruby)/
|
||||
}
|
||||
|
||||
# >0 search/w/1,=#! /usr/bin/lua (len=15), ["Lua script text executable"], swap_endian=0
|
||||
signature file-magic-auto547 {
|
||||
file-mime "text/x-lua", 45
|
||||
|
|
@ -3740,10 +3363,10 @@ signature file-magic-auto556 {
|
|||
}
|
||||
|
||||
# >0 regex,=^extern[ \t\n]+ (len=13), ["C source text"], swap_endian=0
|
||||
signature file-magic-auto557 {
|
||||
file-mime "text/x-c", 43
|
||||
file-magic /(.*)(extern[ \x09\x0a]+)/
|
||||
}
|
||||
#signature file-magic-auto557 {
|
||||
# file-mime "text/x-c", 43
|
||||
# file-magic /(.*)(extern[ \x09\x0a]+)/
|
||||
#}
|
||||
|
||||
# >0 search/4096,=% -*-latex-*- (len=13), ["LaTeX document text"], swap_endian=0
|
||||
signature file-magic-auto558 {
|
||||
|
|
@ -3759,10 +3382,10 @@ signature file-magic-auto558 {
|
|||
#}
|
||||
|
||||
# >0 regex,=^struct[ \t\n]+ (len=13), ["C source text"], swap_endian=0
|
||||
signature file-magic-auto560 {
|
||||
file-mime "text/x-c", 43
|
||||
file-magic /(.*)(struct[ \x09\x0a]+)/
|
||||
}
|
||||
#signature file-magic-auto560 {
|
||||
# file-mime "text/x-c", 43
|
||||
# file-magic /(.*)(struct[ \x09\x0a]+)/
|
||||
#}
|
||||
|
||||
# >0 search/w/1,=#!/bin/nodejs (len=13), ["Node.js script text executable"], swap_endian=0
|
||||
signature file-magic-auto561 {
|
||||
|
|
@ -3815,10 +3438,10 @@ signature file-magic-auto567 {
|
|||
}
|
||||
|
||||
# >0 regex,=^char[ \t\n]+ (len=11), ["C source text"], swap_endian=0
|
||||
signature file-magic-auto568 {
|
||||
file-mime "text/x-c", 41
|
||||
file-magic /(.*)(char[ \x09\x0a]+)/
|
||||
}
|
||||
#signature file-magic-auto568 {
|
||||
# file-mime "text/x-c", 41
|
||||
# file-magic /(.*)(char[ \x09\x0a]+)/
|
||||
#}
|
||||
|
||||
# >0 search/1,=#! (len=2), [""], swap_endian=0
|
||||
# >>0 regex,=^#!.*/bin/perl$ (len=15), ["Perl script text executable"], swap_endian=0
|
||||
|
|
@ -3900,23 +3523,11 @@ signature file-magic-auto578 {
|
|||
file-magic /(^dnl )/
|
||||
}
|
||||
|
||||
# >0 regex,=^all: (len=5), ["makefile script text"], swap_endian=0
|
||||
signature file-magic-auto579 {
|
||||
file-mime "text/x-makefile", 40
|
||||
file-magic /(^all:)/
|
||||
}
|
||||
|
||||
# >0 regex,=^.PRECIOUS (len=10), ["makefile script text"], swap_endian=0
|
||||
signature file-magic-auto580 {
|
||||
file-mime "text/x-makefile", 40
|
||||
file-magic /(^.PRECIOUS)/
|
||||
}
|
||||
|
||||
# >0 search/8192,=main( (len=5), ["C source text"], swap_endian=0
|
||||
signature file-magic-auto581 {
|
||||
file-mime "text/x-c", 40
|
||||
file-magic /(.*)(main\x28)/
|
||||
}
|
||||
#signature file-magic-auto581 {
|
||||
# file-mime "text/x-c", 40
|
||||
# file-magic /(.*)(main\x28)/
|
||||
#}
|
||||
|
||||
# Not specific enough.
|
||||
# >0 search/1,=\" (len=2), ["troff or preprocessor input text"], swap_endian=0
|
||||
|
|
@ -3945,22 +3556,22 @@ signature file-magic-auto584 {
|
|||
#}
|
||||
|
||||
# >0 regex,=^#include (len=9), ["C source text"], swap_endian=0
|
||||
signature file-magic-auto586 {
|
||||
file-mime "text/x-c", 39
|
||||
file-magic /(.*)(#include)/
|
||||
}
|
||||
#signature file-magic-auto586 {
|
||||
# file-mime "text/x-c", 39
|
||||
# file-magic /(.*)(#include)/
|
||||
#}
|
||||
|
||||
# >0 search/1,=.\" (len=3), ["troff or preprocessor input text"], swap_endian=0
|
||||
signature file-magic-auto587 {
|
||||
file-mime "text/troff", 39
|
||||
file-magic /(.*)(\x2e\x5c\x22)/
|
||||
}
|
||||
#signature file-magic-auto587 {
|
||||
# file-mime "text/troff", 39
|
||||
# file-magic /(.*)(\x2e\x5c\x22)/
|
||||
#}
|
||||
|
||||
# >0 search/1,='\" (len=3), ["troff or preprocessor input text"], swap_endian=0
|
||||
signature file-magic-auto588 {
|
||||
file-mime "text/troff", 39
|
||||
file-magic /(.*)(\x27\x5c\x22)/
|
||||
}
|
||||
#signature file-magic-auto588 {
|
||||
# file-mime "text/troff", 39
|
||||
# file-magic /(.*)(\x27\x5c\x22)/
|
||||
#}
|
||||
|
||||
# >0 search/1,=<TeXmacs| (len=9), ["TeXmacs document text"], swap_endian=0
|
||||
signature file-magic-auto589 {
|
||||
|
|
@ -3987,10 +3598,10 @@ signature file-magic-auto592 {
|
|||
}
|
||||
|
||||
# >0 search/1,=''' (len=3), ["troff or preprocessor input text"], swap_endian=0
|
||||
signature file-magic-auto593 {
|
||||
file-mime "text/troff", 39
|
||||
file-magic /(.*)(\x27\x27\x27)/
|
||||
}
|
||||
#signature file-magic-auto593 {
|
||||
# file-mime "text/troff", 39
|
||||
# file-magic /(.*)(\x27\x27\x27)/
|
||||
#}
|
||||
|
||||
# >0 search/4096,=try: (len=4), [""], swap_endian=0
|
||||
# >>&0 regex,=^\s*except.*: (len=13), ["Python script text executable"], swap_endian=0
|
||||
|
|
@ -4012,12 +3623,6 @@ signature file-magic-auto596 {
|
|||
file-magic /(.*)(\x22LIBHDR\x22)/
|
||||
}
|
||||
|
||||
# >0 regex,=^SUBDIRS (len=8), ["automake makefile script text"], swap_endian=0
|
||||
signature file-magic-auto597 {
|
||||
file-mime "text/x-makefile", 38
|
||||
file-magic /(.*)(SUBDIRS)/
|
||||
}
|
||||
|
||||
# >0 search/4096,=(defvar (len=8), ["Lisp/Scheme program text"], swap_endian=0
|
||||
signature file-magic-auto598 {
|
||||
file-mime "text/x-lisp", 38
|
||||
|
|
@ -4044,19 +3649,6 @@ signature file-magic-auto600 {
|
|||
# file-magic /(.*)(\x2a\x2a\x2a )/
|
||||
#}
|
||||
|
||||
# >0 search/1,='.\" (len=4), ["troff or preprocessor input text"], swap_endian=0
|
||||
signature file-magic-auto602 {
|
||||
file-mime "text/troff", 38
|
||||
file-magic /(.*)(\x27\x2e\x5c\x22)/
|
||||
}
|
||||
|
||||
# LDFLAGS appears in other contexts, e.g. shell script.
|
||||
# >0 regex,=^LDFLAGS (len=8), ["makefile script text"], swap_endian=0
|
||||
#signature file-magic-auto603 {
|
||||
# file-mime "text/x-makefile", 38
|
||||
# file-magic /(.*)(LDFLAGS)/
|
||||
#}
|
||||
|
||||
# >0 search/8192,="libhdr" (len=8), ["BCPL source text"], swap_endian=0
|
||||
signature file-magic-auto604 {
|
||||
file-mime "text/x-bcpl", 38
|
||||
|
|
@ -4070,12 +3662,6 @@ signature file-magic-auto604 {
|
|||
# file-magic /(^record)/
|
||||
#}
|
||||
|
||||
# >0 regex,=^CFLAGS (len=7), ["makefile script text"], swap_endian=0
|
||||
signature file-magic-auto606 {
|
||||
file-mime "text/x-makefile", 37
|
||||
file-magic /(.*)(CFLAGS)/
|
||||
}
|
||||
|
||||
# >0 search/4096,=(defun (len=7), ["Lisp/Scheme program text"], swap_endian=0
|
||||
signature file-magic-auto607 {
|
||||
file-mime "text/x-lisp", 37
|
||||
|
|
|
|||
28
scripts/base/frameworks/files/magic/msoffice.sig
Normal file
28
scripts/base/frameworks/files/magic/msoffice.sig
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
|
||||
# This signature is non-specific and terrible but after
|
||||
# searching for a long time there doesn't seem to be a
|
||||
# better option.
|
||||
signature file-msword {
|
||||
file-magic /^\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1/
|
||||
file-mime "application/msword", 50
|
||||
}
|
||||
|
||||
signature file-ooxml {
|
||||
file-magic /^PK\x03\x04\x14\x00\x06\x00/
|
||||
file-mime "application/vnd.openxmlformats-officedocument", 50
|
||||
}
|
||||
|
||||
signature file-docx {
|
||||
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|word\x2f).*PK\x03\x04.{26}word\x2f/
|
||||
file-mime "application/vnd.openxmlformats-officedocument.wordprocessingml.document", 80
|
||||
}
|
||||
|
||||
signature file-xlsx {
|
||||
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|xl\2f).*PK\x03\x04.{26}xl\x2f/
|
||||
file-mime "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", 80
|
||||
}
|
||||
|
||||
signature file-pptx {
|
||||
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|ppt\x2f).*PK\x03\x04.{26}ppt\x2f/
|
||||
file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 80
|
||||
}
|
||||
|
|
@ -56,7 +56,7 @@ export {
|
|||
## local file path which was read, or some other input source.
|
||||
source: string &log &optional;
|
||||
|
||||
## A value to represent the depth of this file in relation
|
||||
## A value to represent the depth of this file in relation
|
||||
## to its source. In SMTP, it is the depth of the MIME
|
||||
## attachment on the message. In HTTP, it is the depth of the
|
||||
## request within the TCP connection.
|
||||
|
|
@ -73,7 +73,7 @@ export {
|
|||
mime_type: string &log &optional;
|
||||
|
||||
## A filename for the file if one is available from the source
|
||||
## for the file. These will frequently come from
|
||||
## for the file. These will frequently come from
|
||||
## "Content-Disposition" headers in network protocols.
|
||||
filename: string &log &optional;
|
||||
|
||||
|
|
@ -100,8 +100,9 @@ export {
|
|||
## during the process of analysis e.g. due to dropped packets.
|
||||
missing_bytes: count &log &default=0;
|
||||
|
||||
## The number of not all-in-sequence bytes in the file stream that
|
||||
## were delivered to file analyzers due to reassembly buffer overflow.
|
||||
## The number of bytes in the file stream that were not delivered to
|
||||
## stream file analyzers. This could be overlapping bytes or
|
||||
## bytes that couldn't be reassembled.
|
||||
overflow_bytes: count &log &default=0;
|
||||
|
||||
## Whether the file analysis timed out at least once for the file.
|
||||
|
|
@ -124,6 +125,37 @@ export {
|
|||
## generate two handles that would hash to the same file id.
|
||||
const salt = "I recommend changing this." &redef;
|
||||
|
||||
## Decide if you want to automatically attached analyzers to
|
||||
## files based on the detected mime type of the file.
|
||||
const analyze_by_mime_type_automatically = T &redef;
|
||||
|
||||
## The default setting for if the file reassembler is enabled for
|
||||
## each file.
|
||||
const enable_reassembler = T &redef;
|
||||
|
||||
## The default per-file reassembly buffer size.
|
||||
const reassembly_buffer_size = 1048576 &redef;
|
||||
|
||||
## Allows the file reassembler to be used if it's necessary because the
|
||||
## file is transferred out of order.
|
||||
##
|
||||
## f: the file.
|
||||
global enable_reassembly: function(f: fa_file);
|
||||
|
||||
## Disables the file reassembler on this file. If the file is not
|
||||
## transferred out of order this will have no effect.
|
||||
##
|
||||
## f: the file.
|
||||
global disable_reassembly: function(f: fa_file);
|
||||
|
||||
## Set the maximum size the reassembly buffer is allowed to grow
|
||||
## for the given file.
|
||||
##
|
||||
## f: the file.
|
||||
##
|
||||
## max: Maximum allowed size of the reassembly buffer.
|
||||
global set_reassembly_buffer_size: function(f: fa_file, max: count);
|
||||
|
||||
## Sets the *timeout_interval* field of :bro:see:`fa_file`, which is
|
||||
## used to determine the length of inactivity that is allowed for a file
|
||||
## before internal state related to it is cleaned up. When used within
|
||||
|
|
@ -149,8 +181,8 @@ export {
|
|||
## Returns: true if the analyzer will be added, or false if analysis
|
||||
## for the file isn't currently active or the *args*
|
||||
## were invalid for the analyzer type.
|
||||
global add_analyzer: function(f: fa_file,
|
||||
tag: Files::Tag,
|
||||
global add_analyzer: function(f: fa_file,
|
||||
tag: Files::Tag,
|
||||
args: AnalyzerArgs &default=AnalyzerArgs()): bool;
|
||||
|
||||
## Removes an analyzer from the analysis of a given file.
|
||||
|
|
@ -196,7 +228,7 @@ export {
|
|||
## A callback to generate a file handle on demand when
|
||||
## one is needed by the core.
|
||||
get_file_handle: function(c: connection, is_orig: bool): string;
|
||||
|
||||
|
||||
## A callback to "describe" a file. In the case of an HTTP
|
||||
## transfer the most obvious description would be the URL.
|
||||
## It's like an extremely compressed version of the normal log.
|
||||
|
|
@ -207,7 +239,7 @@ export {
|
|||
## Register callbacks for protocols that work with the Files framework.
|
||||
## The callbacks must uniquely identify a file and each protocol can
|
||||
## only have a single callback registered for it.
|
||||
##
|
||||
##
|
||||
## tag: Tag for the protocol analyzer having a callback being registered.
|
||||
##
|
||||
## reg: A :bro:see:`Files::ProtoRegistration` record.
|
||||
|
|
@ -225,6 +257,42 @@ export {
|
|||
## callback: Function to execute when the given file analyzer is being added.
|
||||
global register_analyzer_add_callback: function(tag: Files::Tag, callback: function(f: fa_file, args: AnalyzerArgs));
|
||||
|
||||
## Registers a set of MIME types for an analyzer. If a future connection on one of
|
||||
## these types is seen, the analyzer will be automatically assigned to parsing it.
|
||||
## The function *adds* to all MIME types already registered, it doesn't replace
|
||||
## them.
|
||||
##
|
||||
## tag: The tag of the analyzer.
|
||||
##
|
||||
## mts: The set of MIME types, each in the form "foo/bar" (case-insensitive).
|
||||
##
|
||||
## Returns: True if the MIME types were successfully registered.
|
||||
global register_for_mime_types: function(tag: Analyzer::Tag, mts: set[string]) : bool;
|
||||
|
||||
## Registers a MIME type for an analyzer. If a future file with this type is seen,
|
||||
## the analyzer will be automatically assigned to parsing it. The function *adds*
|
||||
## to all MIME types already registered, it doesn't replace them.
|
||||
##
|
||||
## tag: The tag of the analyzer.
|
||||
##
|
||||
## mt: The MIME type in the form "foo/bar" (case-insensitive).
|
||||
##
|
||||
## Returns: True if the MIME type was successfully registered.
|
||||
global register_for_mime_type: function(tag: Analyzer::Tag, mt: string) : bool;
|
||||
|
||||
## Returns a set of all MIME types currently registered for a specific analyzer.
|
||||
##
|
||||
## tag: The tag of the analyzer.
|
||||
##
|
||||
## Returns: The set of MIME types.
|
||||
global registered_mime_types: function(tag: Analyzer::Tag) : set[string];
|
||||
|
||||
## Returns a table of all MIME-type-to-analyzer mappings currently registered.
|
||||
##
|
||||
## Returns: A table mapping each analyzer to the set of MIME types
|
||||
## registered for it.
|
||||
global all_registered_mime_types: function() : table[Analyzer::Tag] of set[string];
|
||||
|
||||
## Event that can be handled to access the Info record as it is sent on
|
||||
## to the logging framework.
|
||||
global log_files: event(rec: Info);
|
||||
|
|
@ -237,6 +305,10 @@ redef record fa_file += {
|
|||
# Store the callbacks for protocol analyzers that have files.
|
||||
global registered_protocols: table[Analyzer::Tag] of ProtoRegistration = table();
|
||||
|
||||
# Store the MIME type to analyzer mappings.
|
||||
global mime_types: table[Analyzer::Tag] of set[string];
|
||||
global mime_type_to_analyzers: table[string] of set[Analyzer::Tag];
|
||||
|
||||
global analyzer_add_callbacks: table[Files::Tag] of function(f: fa_file, args: AnalyzerArgs) = table();
|
||||
|
||||
event bro_init() &priority=5
|
||||
|
|
@ -259,14 +331,12 @@ function set_info(f: fa_file)
|
|||
f$info$source = f$source;
|
||||
f$info$duration = f$last_active - f$info$ts;
|
||||
f$info$seen_bytes = f$seen_bytes;
|
||||
if ( f?$total_bytes )
|
||||
if ( f?$total_bytes )
|
||||
f$info$total_bytes = f$total_bytes;
|
||||
f$info$missing_bytes = f$missing_bytes;
|
||||
f$info$overflow_bytes = f$overflow_bytes;
|
||||
if ( f?$is_orig )
|
||||
f$info$is_orig = f$is_orig;
|
||||
if ( f?$mime_type )
|
||||
f$info$mime_type = f$mime_type;
|
||||
}
|
||||
|
||||
function set_timeout_interval(f: fa_file, t: interval): bool
|
||||
|
|
@ -274,6 +344,21 @@ function set_timeout_interval(f: fa_file, t: interval): bool
|
|||
return __set_timeout_interval(f$id, t);
|
||||
}
|
||||
|
||||
function enable_reassembly(f: fa_file)
|
||||
{
|
||||
__enable_reassembly(f$id);
|
||||
}
|
||||
|
||||
function disable_reassembly(f: fa_file)
|
||||
{
|
||||
__disable_reassembly(f$id);
|
||||
}
|
||||
|
||||
function set_reassembly_buffer_size(f: fa_file, max: count)
|
||||
{
|
||||
__set_reassembly_buffer(f$id, max);
|
||||
}
|
||||
|
||||
function add_analyzer(f: fa_file, tag: Files::Tag, args: AnalyzerArgs): bool
|
||||
{
|
||||
add f$info$analyzers[Files::analyzer_name(tag)];
|
||||
|
|
@ -309,39 +394,6 @@ function analyzer_name(tag: Files::Tag): string
|
|||
return __analyzer_name(tag);
|
||||
}
|
||||
|
||||
event file_new(f: fa_file) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
}
|
||||
|
||||
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
add f$info$conn_uids[c$uid];
|
||||
local cid = c$id;
|
||||
add f$info$tx_hosts[f$is_orig ? cid$orig_h : cid$resp_h];
|
||||
if( |Site::local_nets| > 0 )
|
||||
f$info$local_orig=Site::is_local_addr(f$is_orig ? cid$orig_h : cid$resp_h);
|
||||
|
||||
add f$info$rx_hosts[f$is_orig ? cid$resp_h : cid$orig_h];
|
||||
}
|
||||
|
||||
event file_timeout(f: fa_file) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
f$info$timedout = T;
|
||||
}
|
||||
|
||||
event file_state_remove(f: fa_file) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
}
|
||||
|
||||
event file_state_remove(f: fa_file) &priority=-10
|
||||
{
|
||||
Log::write(Files::LOG, f$info);
|
||||
}
|
||||
|
||||
function register_protocol(tag: Analyzer::Tag, reg: ProtoRegistration): bool
|
||||
{
|
||||
local result = (tag !in registered_protocols);
|
||||
|
|
@ -349,6 +401,46 @@ function register_protocol(tag: Analyzer::Tag, reg: ProtoRegistration): bool
|
|||
return result;
|
||||
}
|
||||
|
||||
function register_for_mime_types(tag: Analyzer::Tag, mime_types: set[string]) : bool
|
||||
{
|
||||
local rc = T;
|
||||
|
||||
for ( mt in mime_types )
|
||||
{
|
||||
if ( ! register_for_mime_type(tag, mt) )
|
||||
rc = F;
|
||||
}
|
||||
|
||||
return rc;
|
||||
}
|
||||
|
||||
function register_for_mime_type(tag: Analyzer::Tag, mt: string) : bool
|
||||
{
|
||||
if ( tag !in mime_types )
|
||||
{
|
||||
mime_types[tag] = set();
|
||||
}
|
||||
add mime_types[tag][mt];
|
||||
|
||||
if ( mt !in mime_type_to_analyzers )
|
||||
{
|
||||
mime_type_to_analyzers[mt] = set();
|
||||
}
|
||||
add mime_type_to_analyzers[mt][tag];
|
||||
|
||||
return T;
|
||||
}
|
||||
|
||||
function registered_mime_types(tag: Analyzer::Tag) : set[string]
|
||||
{
|
||||
return tag in mime_types ? mime_types[tag] : set();
|
||||
}
|
||||
|
||||
function all_registered_mime_types(): table[Analyzer::Tag] of set[string]
|
||||
{
|
||||
return mime_types;
|
||||
}
|
||||
|
||||
function describe(f: fa_file): string
|
||||
{
|
||||
local tag = Analyzer::get_tag(f$source);
|
||||
|
|
@ -367,3 +459,61 @@ event get_file_handle(tag: Analyzer::Tag, c: connection, is_orig: bool) &priorit
|
|||
local handler = registered_protocols[tag];
|
||||
set_file_handle(handler$get_file_handle(c, is_orig));
|
||||
}
|
||||
|
||||
event file_new(f: fa_file) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
|
||||
if ( enable_reassembler )
|
||||
{
|
||||
Files::enable_reassembly(f);
|
||||
Files::set_reassembly_buffer_size(f, reassembly_buffer_size);
|
||||
}
|
||||
}
|
||||
|
||||
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
|
||||
add f$info$conn_uids[c$uid];
|
||||
local cid = c$id;
|
||||
add f$info$tx_hosts[f$is_orig ? cid$orig_h : cid$resp_h];
|
||||
if( |Site::local_nets| > 0 )
|
||||
f$info$local_orig=Site::is_local_addr(f$is_orig ? cid$orig_h : cid$resp_h);
|
||||
|
||||
add f$info$rx_hosts[f$is_orig ? cid$resp_h : cid$orig_h];
|
||||
}
|
||||
|
||||
event file_mime_type(f: fa_file, mime_type: string) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
|
||||
f$info$mime_type = mime_type;
|
||||
|
||||
if ( analyze_by_mime_type_automatically &&
|
||||
mime_type in mime_type_to_analyzers )
|
||||
{
|
||||
local analyzers = mime_type_to_analyzers[mime_type];
|
||||
for ( a in analyzers )
|
||||
{
|
||||
add f$info$analyzers[Files::analyzer_name(a)];
|
||||
Files::add_analyzer(f, a);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event file_timeout(f: fa_file) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
f$info$timedout = T;
|
||||
}
|
||||
|
||||
event file_state_remove(f: fa_file) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
}
|
||||
|
||||
event file_state_remove(f: fa_file) &priority=-10
|
||||
{
|
||||
Log::write(Files::LOG, f$info);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,6 +4,17 @@
|
|||
module Input;
|
||||
|
||||
export {
|
||||
type Event: enum {
|
||||
EVENT_NEW = 0,
|
||||
EVENT_CHANGED = 1,
|
||||
EVENT_REMOVED = 2,
|
||||
};
|
||||
|
||||
type Mode: enum {
|
||||
MANUAL = 0,
|
||||
REREAD = 1,
|
||||
STREAM = 2
|
||||
};
|
||||
|
||||
## The default input reader used. Defaults to `READER_ASCII`.
|
||||
const default_reader = READER_ASCII &redef;
|
||||
|
|
|
|||
|
|
@ -67,6 +67,7 @@ export {
|
|||
IN_ANYWHERE,
|
||||
};
|
||||
|
||||
## Information about a piece of "seen" data.
|
||||
type Seen: record {
|
||||
## The string if the data is about a string.
|
||||
indicator: string &log &optional;
|
||||
|
|
@ -81,6 +82,9 @@ export {
|
|||
## Where the data was discovered.
|
||||
where: Where &log;
|
||||
|
||||
## The name of the node where the match was discovered.
|
||||
node: string &optional &log;
|
||||
|
||||
## If the data was discovered within a connection, the
|
||||
## connection record should go here to give context to the data.
|
||||
conn: connection &optional;
|
||||
|
|
@ -121,7 +125,7 @@ export {
|
|||
sources: set[string] &log &default=string_set();
|
||||
};
|
||||
|
||||
## Intelligence data manipulation functions.
|
||||
## Intelligence data manipulation function.
|
||||
global insert: function(item: Item);
|
||||
|
||||
## Function to declare discovery of a piece of data in order to check
|
||||
|
|
@ -240,6 +244,11 @@ function Intel::seen(s: Seen)
|
|||
s$indicator_type = Intel::ADDR;
|
||||
}
|
||||
|
||||
if ( ! s?$node )
|
||||
{
|
||||
s$node = peer_description;
|
||||
}
|
||||
|
||||
if ( have_full_data )
|
||||
{
|
||||
local items = get_items(s);
|
||||
|
|
@ -281,8 +290,8 @@ event Intel::match(s: Seen, items: set[Item]) &priority=5
|
|||
if ( ! info?$fuid )
|
||||
info$fuid = s$f$id;
|
||||
|
||||
if ( ! info?$file_mime_type && s$f?$mime_type )
|
||||
info$file_mime_type = s$f$mime_type;
|
||||
if ( ! info?$file_mime_type && s$f?$info && s$f$info?$mime_type )
|
||||
info$file_mime_type = s$f$info$mime_type;
|
||||
|
||||
if ( ! info?$file_desc )
|
||||
info$file_desc = Files::describe(s$f);
|
||||
|
|
|
|||
|
|
@ -1,7 +1,5 @@
|
|||
@load ./main
|
||||
@load ./postprocessors
|
||||
@load ./writers/ascii
|
||||
@load ./writers/dataseries
|
||||
@load ./writers/sqlite
|
||||
@load ./writers/elasticsearch
|
||||
@load ./writers/none
|
||||
|
|
|
|||
|
|
@ -5,9 +5,15 @@
|
|||
|
||||
module Log;
|
||||
|
||||
# Log::ID and Log::Writer are defined in types.bif due to circular dependencies.
|
||||
|
||||
export {
|
||||
## Type that defines an ID unique to each log stream. Scripts creating new log
|
||||
## streams need to redef this enum to add their own specific log ID. The log ID
|
||||
## implicitly determines the default name of the generated log file.
|
||||
type Log::ID: enum {
|
||||
## Dummy place-holder.
|
||||
UNKNOWN
|
||||
};
|
||||
|
||||
## If true, local logging is by default enabled for all filters.
|
||||
const enable_local_logging = T &redef;
|
||||
|
||||
|
|
@ -27,13 +33,13 @@ export {
|
|||
const set_separator = "," &redef;
|
||||
|
||||
## String to use for empty fields. This should be different from
|
||||
## *unset_field* to make the output unambiguous.
|
||||
## *unset_field* to make the output unambiguous.
|
||||
## Can be overwritten by individual writers.
|
||||
const empty_field = "(empty)" &redef;
|
||||
|
||||
## String to use for an unset &optional field.
|
||||
## Can be overwritten by individual writers.
|
||||
const unset_field = "-" &redef;
|
||||
const unset_field = "-" &redef;
|
||||
|
||||
## Type defining the content of a logging stream.
|
||||
type Stream: record {
|
||||
|
|
|
|||
|
|
@ -26,20 +26,20 @@ export {
|
|||
## This option is also available as a per-filter ``$config`` option.
|
||||
const use_json = F &redef;
|
||||
|
||||
## Format of timestamps when writing out JSON. By default, the JSON formatter will
|
||||
## use double values for timestamps which represent the number of seconds from the
|
||||
## UNIX epoch.
|
||||
## Format of timestamps when writing out JSON. By default, the JSON
|
||||
## formatter will use double values for timestamps which represent the
|
||||
## number of seconds from the UNIX epoch.
|
||||
const json_timestamps: JSON::TimestampFormat = JSON::TS_EPOCH &redef;
|
||||
|
||||
## If true, include lines with log meta information such as column names
|
||||
## with types, the values of ASCII logging options that are in use, and
|
||||
## the time when the file was opened and closed (the latter at the end).
|
||||
##
|
||||
##
|
||||
## If writing in JSON format, this is implicitly disabled.
|
||||
const include_meta = T &redef;
|
||||
|
||||
## Prefix for lines with meta information.
|
||||
##
|
||||
##
|
||||
## This option is also available as a per-filter ``$config`` option.
|
||||
const meta_prefix = "#" &redef;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,60 +0,0 @@
|
|||
##! Interface for the DataSeries log writer.
|
||||
|
||||
module LogDataSeries;
|
||||
|
||||
export {
|
||||
## Compression to use with the DS output file. Options are:
|
||||
##
|
||||
## 'none' -- No compression.
|
||||
## 'lzf' -- LZF compression (very quick, but leads to larger output files).
|
||||
## 'lzo' -- LZO compression (very fast decompression times).
|
||||
## 'gz' -- GZIP compression (slower than LZF, but also produces smaller output).
|
||||
## 'bz2' -- BZIP2 compression (slower than GZIP, but also produces smaller output).
|
||||
const compression = "gz" &redef;
|
||||
|
||||
## The extent buffer size.
|
||||
## Larger values here lead to better compression and more efficient writes,
|
||||
## but also increase the lag between the time events are received and
|
||||
## the time they are actually written to disk.
|
||||
const extent_size = 65536 &redef;
|
||||
|
||||
## Should we dump the XML schema we use for this DS file to disk?
|
||||
## If yes, the XML schema shares the name of the logfile, but has
|
||||
## an XML ending.
|
||||
const dump_schema = F &redef;
|
||||
|
||||
## How many threads should DataSeries spawn to perform compression?
|
||||
## Note that this dictates the number of threads per log stream. If
|
||||
## you're using a lot of streams, you may want to keep this number
|
||||
## relatively small.
|
||||
##
|
||||
## Default value is 1, which will spawn one thread / stream.
|
||||
##
|
||||
## Maximum is 128, minimum is 1.
|
||||
const num_threads = 1 &redef;
|
||||
|
||||
## Should time be stored as an integer or a double?
|
||||
## Storing time as a double leads to possible precision issues and
|
||||
## can (significantly) increase the size of the resulting DS log.
|
||||
## That said, timestamps stored in double form are consistent
|
||||
## with the rest of Bro, including the standard ASCII log. Hence, we
|
||||
## use them by default.
|
||||
const use_integer_for_time = F &redef;
|
||||
}
|
||||
|
||||
# Default function to postprocess a rotated DataSeries log file. It moves the
|
||||
# rotated file to a new name that includes a timestamp with the opening time,
|
||||
# and then runs the writer's default postprocessor command on it.
|
||||
function default_rotation_postprocessor_func(info: Log::RotationInfo) : bool
|
||||
{
|
||||
# Move file to name including both opening and closing time.
|
||||
local dst = fmt("%s.%s.ds", info$path,
|
||||
strftime(Log::default_rotation_date_format, info$open));
|
||||
|
||||
system(fmt("/bin/mv %s %s", info$fname, dst));
|
||||
|
||||
# Run default postprocessor.
|
||||
return Log::run_rotation_postprocessor_cmd(info, dst);
|
||||
}
|
||||
|
||||
redef Log::default_rotation_postprocessors += { [Log::WRITER_DATASERIES] = default_rotation_postprocessor_func };
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
##! Log writer for sending logs to an ElasticSearch server.
|
||||
##!
|
||||
##! Note: This module is in testing and is not yet considered stable!
|
||||
##!
|
||||
##! There is one known memory issue. If your elasticsearch server is
|
||||
##! running slowly and taking too long to return from bulk insert
|
||||
##! requests, the message queue to the writer thread will continue
|
||||
##! growing larger and larger giving the appearance of a memory leak.
|
||||
|
||||
module LogElasticSearch;
|
||||
|
||||
export {
|
||||
## Name of the ES cluster.
|
||||
const cluster_name = "elasticsearch" &redef;
|
||||
|
||||
## ES server.
|
||||
const server_host = "127.0.0.1" &redef;
|
||||
|
||||
## ES port.
|
||||
const server_port = 9200 &redef;
|
||||
|
||||
## Name of the ES index.
|
||||
const index_prefix = "bro" &redef;
|
||||
|
||||
## The ES type prefix comes before the name of the related log.
|
||||
## e.g. prefix = "bro\_" would create types of bro_dns, bro_software, etc.
|
||||
const type_prefix = "" &redef;
|
||||
|
||||
## The time before an ElasticSearch transfer will timeout. Note that
|
||||
## the fractional part of the timeout will be ignored. In particular,
|
||||
## time specifications less than a second result in a timeout value of
|
||||
## 0, which means "no timeout."
|
||||
const transfer_timeout = 2secs;
|
||||
|
||||
## The batch size is the number of messages that will be queued up before
|
||||
## they are sent to be bulk indexed.
|
||||
const max_batch_size = 1000 &redef;
|
||||
|
||||
## The maximum amount of wall-clock time that is allowed to pass without
|
||||
## finishing a bulk log send. This represents the maximum delay you
|
||||
## would like to have with your logs before they are sent to ElasticSearch.
|
||||
const max_batch_interval = 1min &redef;
|
||||
|
||||
## The maximum byte size for a buffered JSON string to send to the bulk
|
||||
## insert API.
|
||||
const max_byte_size = 1024 * 1024 &redef;
|
||||
}
|
||||
|
||||
|
|
@ -20,7 +20,8 @@ export {
|
|||
## category along with the specific notice separating words with
|
||||
## underscores and using leading capitals on each word except for
|
||||
## abbreviations which are kept in all capitals. For example,
|
||||
## SSH::Login is for heuristically guessed successful SSH logins.
|
||||
## SSH::Password_Guessing is for hosts that have crossed a threshold of
|
||||
## heuristically determined failed SSH logins.
|
||||
type Type: enum {
|
||||
## Notice reporting a count of how often a notice occurred.
|
||||
Tally,
|
||||
|
|
@ -530,8 +531,8 @@ function create_file_info(f: fa_file): Notice::FileInfo
|
|||
local fi: Notice::FileInfo = Notice::FileInfo($fuid = f$id,
|
||||
$desc = Files::describe(f));
|
||||
|
||||
if ( f?$mime_type )
|
||||
fi$mime = f$mime_type;
|
||||
if ( f?$info && f$info?$mime_type )
|
||||
fi$mime = f$info$mime_type;
|
||||
|
||||
if ( f?$conns && |f$conns| == 1 )
|
||||
for ( id in f$conns )
|
||||
|
|
|
|||
|
|
@ -71,7 +71,7 @@ export {
|
|||
## to be logged has occurred.
|
||||
ts: time &log;
|
||||
## A unique identifier of the connection which triggered the
|
||||
## signature match event
|
||||
## signature match event.
|
||||
uid: string &log &optional;
|
||||
## The host which triggered the signature match event.
|
||||
src_addr: addr &log &optional;
|
||||
|
|
|
|||
|
|
@ -75,6 +75,13 @@ type addr_vec: vector of addr;
|
|||
## directly and then remove this alias.
|
||||
type table_string_of_string: table[string] of string;
|
||||
|
||||
## A set of file analyzer tags.
|
||||
##
|
||||
## .. todo:: We need this type definition only for declaring builtin functions
|
||||
## via ``bifcl``. We should extend ``bifcl`` to understand composite types
|
||||
## directly and then remove this alias.
|
||||
type files_tag_set: set[Files::Tag];
|
||||
|
||||
## A structure indicating a MIME type and strength of a match against
|
||||
## file magic signatures.
|
||||
##
|
||||
|
|
@ -346,9 +353,10 @@ type connection: record {
|
|||
## gives up and discards any internal state related to the file.
|
||||
const default_file_timeout_interval: interval = 2 mins &redef;
|
||||
|
||||
## Default amount of bytes that file analysis will buffer before raising
|
||||
## :bro:see:`file_new`.
|
||||
const default_file_bof_buffer_size: count = 1024 &redef;
|
||||
## Default amount of bytes that file analysis will buffer in order to use
|
||||
## for mime type matching. File analyzers attached at the time of mime type
|
||||
## matching or later, will receive a copy of this buffer.
|
||||
const default_file_bof_buffer_size: count = 4096 &redef;
|
||||
|
||||
## A file that Bro is analyzing. This is Bro's type for describing the basic
|
||||
## internal metadata collected about a "file", which is essentially just a
|
||||
|
|
@ -387,8 +395,10 @@ type fa_file: record {
|
|||
## during the process of analysis e.g. due to dropped packets.
|
||||
missing_bytes: count &default=0;
|
||||
|
||||
## The number of not all-in-sequence bytes in the file stream that
|
||||
## were delivered to file analyzers due to reassembly buffer overflow.
|
||||
## The number of bytes in the file stream that were not delivered to
|
||||
## stream file analyzers. Generally, this consists of bytes that
|
||||
## couldn't be reassembled, either because reassembly simply isn't
|
||||
## enabled, or due to size limitations of the reassembly buffer.
|
||||
overflow_bytes: count &default=0;
|
||||
|
||||
## The amount of time between receiving new data for this file that
|
||||
|
|
@ -402,16 +412,6 @@ type fa_file: record {
|
|||
## The content of the beginning of a file up to *bof_buffer_size* bytes.
|
||||
## This is also the buffer that's used for file/mime type detection.
|
||||
bof_buffer: string &optional;
|
||||
|
||||
## The mime type of the strongest file magic signature matches against
|
||||
## the data chunk in *bof_buffer*, or in the cases where no buffering
|
||||
## of the beginning of file occurs, an initial guess of the mime type
|
||||
## based on the first data seen.
|
||||
mime_type: string &optional;
|
||||
|
||||
## All mime types that matched file magic signatures against the data
|
||||
## chunk in *bof_buffer*, in order of their strength value.
|
||||
mime_types: mime_matches &optional;
|
||||
} &redef;
|
||||
|
||||
## Fields of a SYN packet.
|
||||
|
|
@ -2478,8 +2478,7 @@ type http_message_stat: record {
|
|||
header_length: count;
|
||||
};
|
||||
|
||||
## Maximum number of HTTP entity data delivered to events. The amount of data
|
||||
## can be limited for better performance, zero disables truncation.
|
||||
## Maximum number of HTTP entity data delivered to events.
|
||||
##
|
||||
## .. bro:see:: http_entity_data skip_http_entity_data skip_http_data
|
||||
global http_entity_data_delivery_size = 1500 &redef;
|
||||
|
|
@ -2806,6 +2805,7 @@ type ModbusRegisters: vector of count;
|
|||
type ModbusHeaders: record {
|
||||
tid: count;
|
||||
pid: count;
|
||||
len: count;
|
||||
uid: count;
|
||||
function_code: count;
|
||||
};
|
||||
|
|
@ -3431,9 +3431,6 @@ const global_hash_seed: string = "" &redef;
|
|||
## The maximum is currently 128 bits.
|
||||
const bits_per_uid: count = 96 &redef;
|
||||
|
||||
# Load BiFs defined by plugins.
|
||||
@load base/bif/plugins
|
||||
|
||||
# Load these frameworks here because they use fairly deep integration with
|
||||
# BiFs and script-land defined types.
|
||||
@load base/frameworks/logging
|
||||
|
|
@ -3442,3 +3439,7 @@ const bits_per_uid: count = 96 &redef;
|
|||
@load base/frameworks/files
|
||||
|
||||
@load base/bif
|
||||
|
||||
# Load BiFs defined by plugins.
|
||||
@load base/bif/plugins
|
||||
|
||||
|
|
|
|||
|
|
@ -46,6 +46,7 @@
|
|||
@load base/protocols/http
|
||||
@load base/protocols/irc
|
||||
@load base/protocols/modbus
|
||||
@load base/protocols/mysql
|
||||
@load base/protocols/pop3
|
||||
@load base/protocols/radius
|
||||
@load base/protocols/snmp
|
||||
|
|
|
|||
|
|
@ -47,13 +47,13 @@ redef record connection += {
|
|||
const ports = { 67/udp, 68/udp };
|
||||
redef likely_server_ports += { 67/udp };
|
||||
|
||||
event bro_init()
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(DHCP::LOG, [$columns=Info, $ev=log_dhcp]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports);
|
||||
}
|
||||
|
||||
event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string)
|
||||
event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string) &priority=5
|
||||
{
|
||||
local info: Info;
|
||||
info$ts = network_time();
|
||||
|
|
@ -71,6 +71,9 @@ event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_lis
|
|||
info$assigned_ip = c$id$orig_h;
|
||||
|
||||
c$dhcp = info;
|
||||
}
|
||||
|
||||
event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string) &priority=-5
|
||||
{
|
||||
Log::write(DHCP::LOG, c$dhcp);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,5 +5,11 @@ signature dpd_dnp3_server {
|
|||
ip-proto == tcp
|
||||
payload /\x05\x64/
|
||||
tcp-state responder
|
||||
enable "dnp3"
|
||||
enable "dnp3_tcp"
|
||||
}
|
||||
|
||||
signature dpd_dnp3_server_udp {
|
||||
ip-proto == udp
|
||||
payload /\x05\x64/
|
||||
enable "dnp3_udp"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -31,16 +31,16 @@ redef record connection += {
|
|||
dnp3: Info &optional;
|
||||
};
|
||||
|
||||
const ports = { 20000/tcp };
|
||||
const ports = { 20000/tcp , 20000/udp };
|
||||
redef likely_server_ports += { ports };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(DNP3::LOG, [$columns=Info, $ev=log_dnp3]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3, ports);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3_TCP, ports);
|
||||
}
|
||||
|
||||
event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
|
||||
event dnp3_application_request_header(c: connection, is_orig: bool, application_control: count, fc: count)
|
||||
{
|
||||
if ( ! c?$dnp3 )
|
||||
c$dnp3 = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||
|
|
@ -49,7 +49,7 @@ event dnp3_application_request_header(c: connection, is_orig: bool, fc: count)
|
|||
c$dnp3$fc_request = function_codes[fc];
|
||||
}
|
||||
|
||||
event dnp3_application_response_header(c: connection, is_orig: bool, fc: count, iin: count)
|
||||
event dnp3_application_response_header(c: connection, is_orig: bool, application_control: count, fc: count, iin: count)
|
||||
{
|
||||
if ( ! c?$dnp3 )
|
||||
c$dnp3 = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
||||
|
|
|
|||
|
|
@ -17,6 +17,10 @@ export {
|
|||
|
||||
## Describe the file being transferred.
|
||||
global describe_file: function(f: fa_file): string;
|
||||
|
||||
redef record fa_file += {
|
||||
ftp: FTP::Info &optional;
|
||||
};
|
||||
}
|
||||
|
||||
function get_file_handle(c: connection, is_orig: bool): string
|
||||
|
|
@ -48,7 +52,6 @@ event bro_init() &priority=5
|
|||
$describe = FTP::describe_file]);
|
||||
}
|
||||
|
||||
|
||||
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
|
||||
{
|
||||
if ( [c$id$resp_h, c$id$resp_p] !in ftp_data_expected )
|
||||
|
|
@ -56,6 +59,14 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
|
||||
local ftp = ftp_data_expected[c$id$resp_h, c$id$resp_p];
|
||||
ftp$fuid = f$id;
|
||||
if ( f?$mime_type )
|
||||
ftp$mime_type = f$mime_type;
|
||||
|
||||
f$ftp = ftp;
|
||||
}
|
||||
|
||||
event file_mime_type(f: fa_file, mime_type: string) &priority=5
|
||||
{
|
||||
if ( ! f?$ftp )
|
||||
return;
|
||||
|
||||
f$ftp$mime_type = mime_type;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -35,6 +35,10 @@ export {
|
|||
## body.
|
||||
resp_mime_depth: count &default=0;
|
||||
};
|
||||
|
||||
redef record fa_file += {
|
||||
http: HTTP::Info &optional;
|
||||
};
|
||||
}
|
||||
|
||||
event http_begin_entity(c: connection, is_orig: bool) &priority=10
|
||||
|
|
@ -67,6 +71,8 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
{
|
||||
if ( f$source == "HTTP" && c?$http )
|
||||
{
|
||||
f$http = c$http;
|
||||
|
||||
if ( c$http?$current_entity && c$http$current_entity?$filename )
|
||||
f$info$filename = c$http$current_entity$filename;
|
||||
|
||||
|
|
@ -76,14 +82,6 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
c$http$orig_fuids = string_vec(f$id);
|
||||
else
|
||||
c$http$orig_fuids[|c$http$orig_fuids|] = f$id;
|
||||
|
||||
if ( f?$mime_type )
|
||||
{
|
||||
if ( ! c$http?$orig_mime_types )
|
||||
c$http$orig_mime_types = string_vec(f$mime_type);
|
||||
else
|
||||
c$http$orig_mime_types[|c$http$orig_mime_types|] = f$mime_type;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -91,17 +89,29 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
c$http$resp_fuids = string_vec(f$id);
|
||||
else
|
||||
c$http$resp_fuids[|c$http$resp_fuids|] = f$id;
|
||||
|
||||
if ( f?$mime_type )
|
||||
{
|
||||
if ( ! c$http?$resp_mime_types )
|
||||
c$http$resp_mime_types = string_vec(f$mime_type);
|
||||
else
|
||||
c$http$resp_mime_types[|c$http$resp_mime_types|] = f$mime_type;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
event file_mime_type(f: fa_file, mime_type: string) &priority=5
|
||||
{
|
||||
if ( ! f?$http || ! f?$is_orig )
|
||||
return;
|
||||
|
||||
if ( f$is_orig )
|
||||
{
|
||||
if ( ! f$http?$orig_mime_types )
|
||||
f$http$orig_mime_types = string_vec(mime_type);
|
||||
else
|
||||
f$http$orig_mime_types[|f$http$orig_mime_types|] = mime_type;
|
||||
}
|
||||
else
|
||||
{
|
||||
if ( ! f$http?$resp_mime_types )
|
||||
f$http$resp_mime_types = string_vec(mime_type);
|
||||
else
|
||||
f$http$resp_mime_types[|f$http$resp_mime_types|] = mime_type;
|
||||
}
|
||||
}
|
||||
|
||||
event http_end_entity(c: connection, is_orig: bool) &priority=5
|
||||
|
|
|
|||
|
|
@ -12,6 +12,10 @@ export {
|
|||
|
||||
## Default file handle provider for IRC.
|
||||
global get_file_handle: function(c: connection, is_orig: bool): string;
|
||||
|
||||
redef record fa_file += {
|
||||
irc: IRC::Info &optional;
|
||||
};
|
||||
}
|
||||
|
||||
function get_file_handle(c: connection, is_orig: bool): string
|
||||
|
|
@ -34,6 +38,12 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
irc$fuid = f$id;
|
||||
if ( irc?$dcc_file_name )
|
||||
f$info$filename = irc$dcc_file_name;
|
||||
if ( f?$mime_type )
|
||||
irc$dcc_mime_type = f$mime_type;
|
||||
|
||||
f$irc = irc;
|
||||
}
|
||||
|
||||
event file_mime_type(f: fa_file, mime_type: string) &priority=5
|
||||
{
|
||||
if ( f?$irc )
|
||||
f$irc$dcc_mime_type = mime_type;
|
||||
}
|
||||
1
scripts/base/protocols/mysql/__load__.bro
Normal file
1
scripts/base/protocols/mysql/__load__.bro
Normal file
|
|
@ -0,0 +1 @@
|
|||
@load ./main
|
||||
38
scripts/base/protocols/mysql/consts.bro
Normal file
38
scripts/base/protocols/mysql/consts.bro
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
module MySQL;
|
||||
|
||||
export {
|
||||
const commands: table[count] of string = {
|
||||
[0] = "sleep",
|
||||
[1] = "quit",
|
||||
[2] = "init_db",
|
||||
[3] = "query",
|
||||
[4] = "field_list",
|
||||
[5] = "create_db",
|
||||
[6] = "drop_db",
|
||||
[7] = "refresh",
|
||||
[8] = "shutdown",
|
||||
[9] = "statistics",
|
||||
[10] = "process_info",
|
||||
[11] = "connect",
|
||||
[12] = "process_kill",
|
||||
[13] = "debug",
|
||||
[14] = "ping",
|
||||
[15] = "time",
|
||||
[16] = "delayed_insert",
|
||||
[17] = "change_user",
|
||||
[18] = "binlog_dump",
|
||||
[19] = "table_dump",
|
||||
[20] = "connect_out",
|
||||
[21] = "register_slave",
|
||||
[22] = "stmt_prepare",
|
||||
[23] = "stmt_execute",
|
||||
[24] = "stmt_send_long_data",
|
||||
[25] = "stmt_close",
|
||||
[26] = "stmt_reset",
|
||||
[27] = "set_option",
|
||||
[28] = "stmt_fetch",
|
||||
[29] = "daemon",
|
||||
[30] = "binlog_dump_gtid",
|
||||
[31] = "reset_connection",
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
}
|
||||
132
scripts/base/protocols/mysql/main.bro
Normal file
132
scripts/base/protocols/mysql/main.bro
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
##! Implements base functionality for MySQL analysis. Generates the mysql.log file.
|
||||
|
||||
module MySQL;
|
||||
|
||||
@load ./consts
|
||||
|
||||
export {
|
||||
redef enum Log::ID += { mysql::LOG };
|
||||
|
||||
type Info: record {
|
||||
## Timestamp for when the event happened.
|
||||
ts: time &log;
|
||||
## Unique ID for the connection.
|
||||
uid: string &log;
|
||||
## The connection's 4-tuple of endpoint addresses/ports.
|
||||
id: conn_id &log;
|
||||
## The command that was issued
|
||||
cmd: string &log;
|
||||
## The argument issued to the command
|
||||
arg: string &log;
|
||||
## Did the server tell us that the command succeeded?
|
||||
success: bool &log &optional;
|
||||
## The number of affected rows, if any
|
||||
rows: count &log &optional;
|
||||
## Server message, if any
|
||||
response: string &log &optional;
|
||||
};
|
||||
|
||||
## Event that can be handled to access the MySQL record as it is sent on
|
||||
## to the logging framework.
|
||||
global log_mysql: event(rec: Info);
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
mysql: Info &optional;
|
||||
};
|
||||
|
||||
const ports = { 1434/tcp, 3306/tcp };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(mysql::LOG, [$columns=Info, $ev=log_mysql]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_MYSQL, ports);
|
||||
}
|
||||
|
||||
event mysql_handshake(c: connection, username: string)
|
||||
{
|
||||
if ( ! c?$mysql )
|
||||
{
|
||||
local info: Info;
|
||||
info$ts = network_time();
|
||||
info$uid = c$uid;
|
||||
info$id = c$id;
|
||||
info$cmd = "login";
|
||||
info$arg = username;
|
||||
c$mysql = info;
|
||||
}
|
||||
}
|
||||
|
||||
event mysql_command_request(c: connection, command: count, arg: string) &priority=5
|
||||
{
|
||||
if ( c?$mysql )
|
||||
{
|
||||
# We got a request, but we haven't logged our
|
||||
# previous request yet, so let's do that now.
|
||||
Log::write(mysql::LOG, c$mysql);
|
||||
delete c$mysql;
|
||||
}
|
||||
|
||||
local info: Info;
|
||||
info$ts = network_time();
|
||||
info$uid = c$uid;
|
||||
info$id = c$id;
|
||||
info$cmd = commands[command];
|
||||
info$arg = sub(arg, /\0$/, "");
|
||||
c$mysql = info;
|
||||
}
|
||||
|
||||
event mysql_command_request(c: connection, command: count, arg: string) &priority=-5
|
||||
{
|
||||
if ( c?$mysql && c$mysql?$cmd && c$mysql$cmd == "quit" )
|
||||
{
|
||||
# We get no response for quits, so let's just log it now.
|
||||
Log::write(mysql::LOG, c$mysql);
|
||||
delete c$mysql;
|
||||
}
|
||||
}
|
||||
|
||||
event mysql_error(c: connection, code: count, msg: string) &priority=5
|
||||
{
|
||||
if ( c?$mysql )
|
||||
{
|
||||
c$mysql$success = F;
|
||||
c$mysql$response = msg;
|
||||
}
|
||||
}
|
||||
|
||||
event mysql_error(c: connection, code: count, msg: string) &priority=-5
|
||||
{
|
||||
if ( c?$mysql )
|
||||
{
|
||||
Log::write(mysql::LOG, c$mysql);
|
||||
delete c$mysql;
|
||||
}
|
||||
}
|
||||
|
||||
event mysql_ok(c: connection, affected_rows: count) &priority=5
|
||||
{
|
||||
if ( c?$mysql )
|
||||
{
|
||||
c$mysql$success = T;
|
||||
c$mysql$rows = affected_rows;
|
||||
}
|
||||
}
|
||||
|
||||
event mysql_ok(c: connection, affected_rows: count) &priority=-5
|
||||
{
|
||||
if ( c?$mysql )
|
||||
{
|
||||
Log::write(mysql::LOG, c$mysql);
|
||||
delete c$mysql;
|
||||
}
|
||||
}
|
||||
|
||||
event connection_state_remove(c: connection) &priority=-5
|
||||
{
|
||||
if ( c?$mysql )
|
||||
{
|
||||
Log::write(mysql::LOG, c$mysql);
|
||||
delete c$mysql;
|
||||
}
|
||||
}
|
||||
|
|
@ -58,31 +58,31 @@ export {
|
|||
## Indicates if client activity has been seen, but not yet logged.
|
||||
has_client_activity: bool &default=F;
|
||||
};
|
||||
|
||||
|
||||
type State: record {
|
||||
helo: string &optional;
|
||||
## Count the number of individual messages transmitted during
|
||||
## this SMTP session. Note, this is not the number of
|
||||
## recipients, but the number of message bodies transferred.
|
||||
messages_transferred: count &default=0;
|
||||
|
||||
|
||||
pending_messages: set[Info] &optional;
|
||||
};
|
||||
|
||||
|
||||
## Direction to capture the full "Received from" path.
|
||||
## REMOTE_HOSTS - only capture the path until an internal host is found.
|
||||
## LOCAL_HOSTS - only capture the path until the external host is discovered.
|
||||
## ALL_HOSTS - always capture the entire path.
|
||||
## NO_HOSTS - never capture the path.
|
||||
const mail_path_capture = ALL_HOSTS &redef;
|
||||
|
||||
|
||||
## Create an extremely shortened representation of a log line.
|
||||
global describe: function(rec: Info): string;
|
||||
|
||||
global log_smtp: event(rec: Info);
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
redef record connection += {
|
||||
smtp: Info &optional;
|
||||
smtp_state: State &optional;
|
||||
};
|
||||
|
|
@ -95,7 +95,7 @@ event bro_init() &priority=5
|
|||
Log::create_stream(SMTP::LOG, [$columns=SMTP::Info, $ev=log_smtp]);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_SMTP, ports);
|
||||
}
|
||||
|
||||
|
||||
function find_address_in_smtp_header(header: string): string
|
||||
{
|
||||
local ips = find_ip_addresses(header);
|
||||
|
|
@ -116,17 +116,17 @@ function new_smtp_log(c: connection): Info
|
|||
l$ts=network_time();
|
||||
l$uid=c$uid;
|
||||
l$id=c$id;
|
||||
# The messages_transferred count isn't incremented until the message is
|
||||
# The messages_transferred count isn't incremented until the message is
|
||||
# finished so we need to increment the count by 1 here.
|
||||
l$trans_depth = c$smtp_state$messages_transferred+1;
|
||||
|
||||
|
||||
if ( c$smtp_state?$helo )
|
||||
l$helo = c$smtp_state$helo;
|
||||
|
||||
|
||||
# The path will always end with the hosts involved in this connection.
|
||||
# The lower values in the vector are the end of the path.
|
||||
l$path = vector(c$id$resp_h, c$id$orig_h);
|
||||
|
||||
|
||||
return l;
|
||||
}
|
||||
|
||||
|
|
@ -134,7 +134,7 @@ function set_smtp_session(c: connection)
|
|||
{
|
||||
if ( ! c?$smtp_state )
|
||||
c$smtp_state = [];
|
||||
|
||||
|
||||
if ( ! c?$smtp )
|
||||
c$smtp = new_smtp_log(c);
|
||||
}
|
||||
|
|
@ -142,17 +142,17 @@ function set_smtp_session(c: connection)
|
|||
function smtp_message(c: connection)
|
||||
{
|
||||
if ( c$smtp$has_client_activity )
|
||||
{
|
||||
Log::write(SMTP::LOG, c$smtp);
|
||||
c$smtp = new_smtp_log(c);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &priority=5
|
||||
{
|
||||
set_smtp_session(c);
|
||||
local upper_command = to_upper(command);
|
||||
|
||||
if ( upper_command != "QUIT" )
|
||||
c$smtp$has_client_activity = T;
|
||||
|
||||
if ( upper_command == "HELO" || upper_command == "EHLO" )
|
||||
{
|
||||
c$smtp_state$helo = arg;
|
||||
|
|
@ -161,23 +161,28 @@ event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &
|
|||
|
||||
else if ( upper_command == "RCPT" && /^[tT][oO]:/ in arg )
|
||||
{
|
||||
if ( ! c$smtp?$rcptto )
|
||||
if ( ! c$smtp?$rcptto )
|
||||
c$smtp$rcptto = set();
|
||||
add c$smtp$rcptto[split1(arg, /:[[:blank:]]*/)[2]];
|
||||
c$smtp$has_client_activity = T;
|
||||
}
|
||||
|
||||
else if ( upper_command == "MAIL" && /^[fF][rR][oO][mM]:/ in arg )
|
||||
{
|
||||
# Flush last message in case we didn't see the server's acknowledgement.
|
||||
smtp_message(c);
|
||||
|
||||
local partially_done = split1(arg, /:[[:blank:]]*/)[2];
|
||||
c$smtp$mailfrom = split1(partially_done, /[[:blank:]]?/)[1];
|
||||
c$smtp$has_client_activity = T;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
||||
msg: string, cont_resp: bool) &priority=5
|
||||
{
|
||||
set_smtp_session(c);
|
||||
|
||||
|
||||
# This continually overwrites, but we want the last reply,
|
||||
# so this actually works fine.
|
||||
c$smtp$last_reply = fmt("%d %s", code, msg);
|
||||
|
|
@ -198,7 +203,6 @@ event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
|
|||
event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
||||
{
|
||||
if ( ! c?$smtp ) return;
|
||||
c$smtp$has_client_activity = T;
|
||||
|
||||
if ( h$name == "MESSAGE-ID" )
|
||||
c$smtp$msg_id = h$value;
|
||||
|
|
@ -241,19 +245,19 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
|||
if ( 1 in addresses )
|
||||
c$smtp$x_originating_ip = to_addr(addresses[1]);
|
||||
}
|
||||
|
||||
|
||||
else if ( h$name == "X-MAILER" ||
|
||||
h$name == "USER-AGENT" ||
|
||||
h$name == "X-USER-AGENT" )
|
||||
c$smtp$user_agent = h$value;
|
||||
}
|
||||
|
||||
# This event handler builds the "Received From" path by reading the
|
||||
|
||||
# This event handler builds the "Received From" path by reading the
|
||||
# headers in the mail
|
||||
event mime_one_header(c: connection, h: mime_header_rec) &priority=3
|
||||
{
|
||||
# If we've decided that we're done watching the received headers for
|
||||
# whatever reason, we're done. Could be due to only watching until
|
||||
# whatever reason, we're done. Could be due to only watching until
|
||||
# local addresses are seen in the received from headers.
|
||||
if ( ! c?$smtp || h$name != "RECEIVED" || ! c$smtp$process_received_from )
|
||||
return;
|
||||
|
|
@ -263,7 +267,7 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=3
|
|||
return;
|
||||
local ip = to_addr(text_ip);
|
||||
|
||||
if ( ! addr_matches_host(ip, mail_path_capture) &&
|
||||
if ( ! addr_matches_host(ip, mail_path_capture) &&
|
||||
! Site::is_private_addr(ip) )
|
||||
{
|
||||
c$smtp$process_received_from = F;
|
||||
|
|
@ -281,7 +285,10 @@ event connection_state_remove(c: connection) &priority=-5
|
|||
event smtp_starttls(c: connection) &priority=5
|
||||
{
|
||||
if ( c?$smtp )
|
||||
{
|
||||
c$smtp$tls = T;
|
||||
c$smtp$has_client_activity = T;
|
||||
}
|
||||
}
|
||||
|
||||
function describe(rec: Info): string
|
||||
|
|
|
|||
|
|
@ -30,6 +30,7 @@ export {
|
|||
const HELLO_REQUEST = 0;
|
||||
const CLIENT_HELLO = 1;
|
||||
const SERVER_HELLO = 2;
|
||||
const HELLO_VERIFY_REQUEST = 3; # RFC 6347
|
||||
const SESSION_TICKET = 4; # RFC 5077
|
||||
const CERTIFICATE = 11;
|
||||
const SERVER_KEY_EXCHANGE = 12;
|
||||
|
|
@ -40,6 +41,7 @@ export {
|
|||
const FINISHED = 20;
|
||||
const CERTIFICATE_URL = 21; # RFC 3546
|
||||
const CERTIFICATE_STATUS = 22; # RFC 3546
|
||||
const SUPPLEMENTAL_DATA = 23; # RFC 4680
|
||||
|
||||
## Mapping between numeric codes and human readable strings for alert
|
||||
## levels.
|
||||
|
|
@ -112,7 +114,8 @@ export {
|
|||
[19] = "client_certificate_type",
|
||||
[20] = "server_certificate_type",
|
||||
[21] = "padding", # temporary till 2015-03-12
|
||||
[22] = "encrypt_then_mac", # temporary till 2015-06-05
|
||||
[22] = "encrypt_then_mac",
|
||||
[23] = "extended_master_secret", # temporary till 2015-09-26
|
||||
[35] = "SessionTicket TLS",
|
||||
[40] = "extended_random",
|
||||
[13172] = "next_protocol_negotiation",
|
||||
|
|
@ -155,6 +158,11 @@ export {
|
|||
[26] = "brainpoolP256r1",
|
||||
[27] = "brainpoolP384r1",
|
||||
[28] = "brainpoolP512r1",
|
||||
# draft-ietf-tls-negotiated-ff-dhe-05
|
||||
[256] = "ffdhe2048",
|
||||
[257] = "ffdhe3072",
|
||||
[258] = "ffdhe4096",
|
||||
[259] = "ffdhe8192",
|
||||
[0xFF01] = "arbitrary_explicit_prime_curves",
|
||||
[0xFF02] = "arbitrary_explicit_char2_curves"
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ export {
|
|||
## Time when the SSL connection was first detected.
|
||||
ts: time &log;
|
||||
## Unique ID for the connection.
|
||||
uid: string &log;
|
||||
uid: string &log;
|
||||
## The connection's 4-tuple of endpoint addresses/ports.
|
||||
id: conn_id &log;
|
||||
## SSL/TLS version that the server offered.
|
||||
|
|
@ -25,9 +25,25 @@ export {
|
|||
## indicates the server name that the client was requesting.
|
||||
server_name: string &log &optional;
|
||||
## Session ID offered by the client for session resumption.
|
||||
session_id: string &log &optional;
|
||||
## Not used for logging.
|
||||
session_id: string &optional;
|
||||
## Flag to indicate if the session was resumed reusing
|
||||
## the key material exchanged in an earlier connection.
|
||||
resumed: bool &log &default=F;
|
||||
## Flag to indicate if we saw a non-empty session ticket being
|
||||
## sent by the client using an empty session ID. This value
|
||||
## is used to determine if a session is being resumed. It's
|
||||
## not logged.
|
||||
client_ticket_empty_session_seen: bool &default=F;
|
||||
## Flag to indicate if we saw a client key exchange message sent
|
||||
## by the client. This value is used to determine if a session
|
||||
## is being resumed. It's not logged.
|
||||
client_key_exchange_seen: bool &default=F;
|
||||
## Last alert that was seen during the connection.
|
||||
last_alert: string &log &optional;
|
||||
## Next protocol the server chose using the application layer
|
||||
## next protocol extension, if present.
|
||||
next_protocol: string &log &optional;
|
||||
|
||||
## The analyzer ID used for the analyzer instance attached
|
||||
## to each connection. It is not used for logging since it's a
|
||||
|
|
@ -36,11 +52,11 @@ export {
|
|||
|
||||
## Flag to indicate if this ssl session has been established
|
||||
## succesfully, or if it was aborted during the handshake.
|
||||
established: bool &log &default=F;
|
||||
established: bool &log &default=F;
|
||||
|
||||
## Flag to indicate if this record already has been logged, to
|
||||
## prevent duplicates.
|
||||
logged: bool &default=F;
|
||||
logged: bool &default=F;
|
||||
};
|
||||
|
||||
## The default root CA bundle. By default, the mozilla-ca-list.bro
|
||||
|
|
@ -149,8 +165,11 @@ event ssl_client_hello(c: connection, version: count, possible_ts: time, client_
|
|||
set_session(c);
|
||||
|
||||
# Save the session_id if there is one set.
|
||||
if ( session_id != /^\x00{32}$/ )
|
||||
if ( |session_id| > 0 && session_id != /^\x00{32}$/ )
|
||||
{
|
||||
c$ssl$session_id = bytestring_to_hexstr(session_id);
|
||||
c$ssl$client_ticket_empty_session_seen = F;
|
||||
}
|
||||
}
|
||||
|
||||
event ssl_server_hello(c: connection, version: count, possible_ts: time, server_random: string, session_id: string, cipher: count, comp_method: count) &priority=5
|
||||
|
|
@ -159,6 +178,9 @@ event ssl_server_hello(c: connection, version: count, possible_ts: time, server_
|
|||
|
||||
c$ssl$version = version_strings[version];
|
||||
c$ssl$cipher = cipher_desc[cipher];
|
||||
|
||||
if ( c$ssl?$session_id && c$ssl$session_id == bytestring_to_hexstr(session_id) )
|
||||
c$ssl$resumed = T;
|
||||
}
|
||||
|
||||
event ssl_server_curve(c: connection, curve: count) &priority=5
|
||||
|
|
@ -180,6 +202,45 @@ event ssl_extension_server_name(c: connection, is_orig: bool, names: string_vec)
|
|||
}
|
||||
}
|
||||
|
||||
event ssl_extension_application_layer_protocol_negotiation(c: connection, is_orig: bool, protocols: string_vec)
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( is_orig )
|
||||
return;
|
||||
|
||||
if ( |protocols| > 0 )
|
||||
c$ssl$next_protocol = protocols[0];
|
||||
}
|
||||
|
||||
event ssl_handshake_message(c: connection, is_orig: bool, msg_type: count, length: count) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( is_orig && msg_type == SSL::CLIENT_KEY_EXCHANGE )
|
||||
c$ssl$client_key_exchange_seen = T;
|
||||
}
|
||||
|
||||
# Extension event is fired _before_ the respective client or server hello.
|
||||
# Important for client_ticket_empty_session_seen.
|
||||
event ssl_extension(c: connection, is_orig: bool, code: count, val: string) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( is_orig && SSL::extensions[code] == "SessionTicket TLS" && |val| > 0 )
|
||||
# In this case, we might have an empty ID. Set back to F in client_hello event
|
||||
# if it is not empty after all.
|
||||
c$ssl$client_ticket_empty_session_seen = T;
|
||||
}
|
||||
|
||||
event ssl_change_cipher_spec(c: connection, is_orig: bool) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
if ( is_orig && c$ssl$client_ticket_empty_session_seen && ! c$ssl$client_key_exchange_seen )
|
||||
c$ssl$resumed = T;
|
||||
}
|
||||
|
||||
event ssl_alert(c: connection, is_orig: bool, level: count, desc: count) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
|
|
|||
|
|
@ -65,12 +65,14 @@ function request2curl(r: Request, bodyfile: string, headersfile: string): string
|
|||
cmd = fmt("%s -m %.0f", cmd, r$max_time);
|
||||
|
||||
if ( r?$client_data )
|
||||
cmd = fmt("%s -d -", cmd);
|
||||
cmd = fmt("%s -d @-", cmd);
|
||||
|
||||
if ( r?$addl_curl_args )
|
||||
cmd = fmt("%s %s", cmd, r$addl_curl_args);
|
||||
|
||||
cmd = fmt("%s \"%s\"", cmd, str_shell_escape(r$url));
|
||||
# Make sure file will exist even if curl did not write one.
|
||||
cmd = fmt("%s && touch %s", cmd, str_shell_escape(bodyfile));
|
||||
return cmd;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -96,8 +96,9 @@ event Exec::file_line(description: Input::EventDescription, tpe: Input::Event, s
|
|||
result$files[track_file][|result$files[track_file]|] = s;
|
||||
}
|
||||
|
||||
event Input::end_of_data(name: string, source:string)
|
||||
event Input::end_of_data(orig_name: string, source:string)
|
||||
{
|
||||
local name = orig_name;
|
||||
local parts = split1(name, /_/);
|
||||
name = parts[1];
|
||||
|
||||
|
|
@ -106,6 +107,15 @@ event Input::end_of_data(name: string, source:string)
|
|||
|
||||
local track_file = parts[2];
|
||||
|
||||
# If the file is empty, still add it to the result$files table. This is needed
|
||||
# because it is expected that the file was read even if it was empty.
|
||||
local result = results[name];
|
||||
if ( ! result?$files )
|
||||
result$files = table();
|
||||
|
||||
if ( track_file !in result$files )
|
||||
result$files[track_file] = vector();
|
||||
|
||||
Input::remove(name);
|
||||
|
||||
if ( name !in pending_files )
|
||||
|
|
|
|||
|
|
@ -3,6 +3,28 @@
|
|||
## A regular expression for matching and extracting URLs.
|
||||
const url_regex = /^([a-zA-Z\-]{3,5})(:\/\/[^\/?#"'\r\n><]*)([^?#"'\r\n><]*)([^[:blank:]\r\n"'><]*|\??[^"'\r\n><]*)/ &redef;
|
||||
|
||||
## A URI, as parsed by :bro:id:`decompose_uri`.
|
||||
type URI: record {
|
||||
## The URL's scheme..
|
||||
scheme: string &optional;
|
||||
## The location, which could be a domain name or an IP address. Left empty if not
|
||||
## specified.
|
||||
netlocation: string;
|
||||
## Port number, if included in URI.
|
||||
portnum: count &optional;
|
||||
## Full including the file name. Will be '/' if there's not path given.
|
||||
path: string;
|
||||
## Full file name, including extension, if there is a file name.
|
||||
file_name: string &optional;
|
||||
## The base filename, without extension, if there is a file name.
|
||||
file_base: string &optional;
|
||||
## The filename's extension, if there is a file name.
|
||||
file_ext: string &optional;
|
||||
## A table of all query parameters, mapping their keys to values, if there's a
|
||||
## query.
|
||||
params: table[string] of string &optional;
|
||||
};
|
||||
|
||||
## Extracts URLs discovered in arbitrary text.
|
||||
function find_all_urls(s: string): string_set
|
||||
{
|
||||
|
|
@ -23,3 +45,84 @@ function find_all_urls_without_scheme(s: string): string_set
|
|||
|
||||
return return_urls;
|
||||
}
|
||||
|
||||
function decompose_uri(s: string): URI
|
||||
{
|
||||
local parts: string_array;
|
||||
local u: URI = [$netlocation="", $path="/"];
|
||||
|
||||
if ( /\?/ in s)
|
||||
{
|
||||
# Parse query.
|
||||
u$params = table();
|
||||
|
||||
parts = split1(s, /\?/);
|
||||
s = parts[1];
|
||||
local query: string = parts[2];
|
||||
|
||||
if ( /&/ in query )
|
||||
{
|
||||
local opv: table[count] of string = split(query, /&/);
|
||||
|
||||
for ( each in opv )
|
||||
{
|
||||
if ( /=/ in opv[each] )
|
||||
{
|
||||
parts = split1(opv[each], /=/);
|
||||
u$params[parts[1]] = parts[2];
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
parts = split1(query, /=/);
|
||||
u$params[parts[1]] = parts[2];
|
||||
}
|
||||
}
|
||||
|
||||
if ( /:\/\// in s )
|
||||
{
|
||||
# Parse scheme and remove from s.
|
||||
parts = split1(s, /:\/\//);
|
||||
u$scheme = parts[1];
|
||||
s = parts[2];
|
||||
}
|
||||
|
||||
if ( /\// in s )
|
||||
{
|
||||
# Parse path and remove from s.
|
||||
parts = split1(s, /\//);
|
||||
s = parts[1];
|
||||
u$path = fmt("/%s", parts[2]);
|
||||
|
||||
if ( |u$path| > 1 && u$path[|u$path| - 1] != "/" )
|
||||
{
|
||||
local last_token: string = find_last(u$path, /\/.+/);
|
||||
local full_filename = split1(last_token, /\//)[2];
|
||||
|
||||
if ( /\./ in full_filename )
|
||||
{
|
||||
u$file_name = full_filename;
|
||||
u$file_base = split1(full_filename, /\./)[1];
|
||||
u$file_ext = split1(full_filename, /\./)[2];
|
||||
}
|
||||
else
|
||||
{
|
||||
u$file_name = full_filename;
|
||||
u$file_base = full_filename;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ( /:/ in s )
|
||||
{
|
||||
# Parse location and port.
|
||||
parts = split1(s, /:/);
|
||||
u$netlocation = parts[1];
|
||||
u$portnum = to_count(parts[2]);
|
||||
}
|
||||
else
|
||||
u$netlocation = s;
|
||||
|
||||
return u;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue