mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Weird settings: make constants into options.
The new weird settings are now all updateable during runtime.
This commit is contained in:
Johanna Amann
parent
5c68093bc3
commit
bec98b98f3
9 changed files with 675 additions and 12 deletions
|
|
@ -1,2 +1,3 @@
|
||||||
@load ./main
|
@load ./main
|
||||||
@load ./input
|
@load ./input
|
||||||
|
@load ./weird
|
||||||
|
|
|
||||||
44
scripts/base/frameworks/config/weird.bro
Normal file
44
scripts/base/frameworks/config/weird.bro
Normal file
|
|
@ -0,0 +1,44 @@
|
||||||
|
##! This script sets up the config framework change handlers for weirds.
|
||||||
|
|
||||||
|
@load ./main
|
||||||
|
|
||||||
|
module Config;
|
||||||
|
|
||||||
|
function weird_option_change_sampling_whitelist(ID: string, new_value: string_set, location: string) : string_set
|
||||||
|
{
|
||||||
|
if ( ID == "Weird::sampling_whitelist" )
|
||||||
|
{
|
||||||
|
Reporter::set_weird_sampling_whitelist(new_value);
|
||||||
|
}
|
||||||
|
return new_value;
|
||||||
|
}
|
||||||
|
|
||||||
|
function weird_option_change_count(ID: string, new_value: count, location: string) : count
|
||||||
|
{
|
||||||
|
if ( ID == "Weird::sampling_threshold" )
|
||||||
|
{
|
||||||
|
Reporter::set_weird_sampling_threshold(new_value);
|
||||||
|
}
|
||||||
|
else if ( ID == "Weird::sampling_rate" )
|
||||||
|
{
|
||||||
|
Reporter::set_weird_sampling_rate(new_value);
|
||||||
|
}
|
||||||
|
return new_value;
|
||||||
|
}
|
||||||
|
|
||||||
|
function weird_option_change_interval(ID: string, new_value: interval, location: string) : interval
|
||||||
|
{
|
||||||
|
if ( ID == "Weird::sampling_duration" )
|
||||||
|
{
|
||||||
|
Reporter::set_weird_sampling_duration(new_value);
|
||||||
|
}
|
||||||
|
return new_value;
|
||||||
|
}
|
||||||
|
|
||||||
|
event bro_init() &priority=5
|
||||||
|
{
|
||||||
|
Option::set_change_handler("Weird::sampling_whitelist", weird_option_change_sampling_whitelist, 5);
|
||||||
|
Option::set_change_handler("Weird::sampling_threshold", weird_option_change_count, 5);
|
||||||
|
Option::set_change_handler("Weird::sampling_rate", weird_option_change_count, 5);
|
||||||
|
Option::set_change_handler("Weird::sampling_duration", weird_option_change_interval, 5);
|
||||||
|
}
|
||||||
|
|
@ -4847,18 +4847,18 @@ export {
|
||||||
module Weird;
|
module Weird;
|
||||||
export {
|
export {
|
||||||
## Prevents rate-limiting sampling of any weirds named in the table.
|
## Prevents rate-limiting sampling of any weirds named in the table.
|
||||||
const sampling_whitelist: set[string] &redef;
|
option sampling_whitelist: set[string] = {};
|
||||||
|
|
||||||
## How many weirds of a given type to tolerate before sampling begins.
|
## How many weirds of a given type to tolerate before sampling begins.
|
||||||
## I.e. this many consecutive weirds of a given type will be allowed to
|
## I.e. this many consecutive weirds of a given type will be allowed to
|
||||||
## raise events for script-layer handling before being rate-limited.
|
## raise events for script-layer handling before being rate-limited.
|
||||||
const sampling_threshold = 25 &redef;
|
option sampling_threshold : count = 25;
|
||||||
|
|
||||||
## The rate-limiting sampling rate. One out of every of this number of
|
## The rate-limiting sampling rate. One out of every of this number of
|
||||||
## rate-limited weirds of a given type will be allowed to raise events
|
## rate-limited weirds of a given type will be allowed to raise events
|
||||||
## for further script-layer handling. Setting the sampling rate to 0
|
## for further script-layer handling. Setting the sampling rate to 0
|
||||||
## will disable all output of rate-limited weirds.
|
## will disable all output of rate-limited weirds.
|
||||||
const sampling_rate = 1000 &redef;
|
option sampling_rate : count = 1000;
|
||||||
|
|
||||||
## How long a weird of a given type is allowed to keep state/counters in
|
## How long a weird of a given type is allowed to keep state/counters in
|
||||||
## memory. For "net" weirds an expiration timer starts per weird name when
|
## memory. For "net" weirds an expiration timer starts per weird name when
|
||||||
|
|
@ -4871,7 +4871,7 @@ export {
|
||||||
## begins for "foo" and upon triggering will reset the counter for "foo"
|
## begins for "foo" and upon triggering will reset the counter for "foo"
|
||||||
## and unthrottle its rate-limiting until it once again exceeds the
|
## and unthrottle its rate-limiting until it once again exceeds the
|
||||||
## threshold.
|
## threshold.
|
||||||
const sampling_duration = 10min &redef;
|
option sampling_duration = 10min;
|
||||||
}
|
}
|
||||||
|
|
||||||
module GLOBAL;
|
module GLOBAL;
|
||||||
|
|
|
||||||
|
|
@ -52,13 +52,13 @@ Reporter::~Reporter()
|
||||||
|
|
||||||
void Reporter::InitOptions()
|
void Reporter::InitOptions()
|
||||||
{
|
{
|
||||||
info_to_stderr = internal_const_val("Reporter::info_to_stderr")->AsBool();
|
info_to_stderr = internal_val("Reporter::info_to_stderr")->AsBool();
|
||||||
warnings_to_stderr = internal_const_val("Reporter::warnings_to_stderr")->AsBool();
|
warnings_to_stderr = internal_val("Reporter::warnings_to_stderr")->AsBool();
|
||||||
errors_to_stderr = internal_const_val("Reporter::errors_to_stderr")->AsBool();
|
errors_to_stderr = internal_val("Reporter::errors_to_stderr")->AsBool();
|
||||||
weird_sampling_rate = internal_const_val("Weird::sampling_rate")->AsCount();
|
weird_sampling_rate = internal_val("Weird::sampling_rate")->AsCount();
|
||||||
weird_sampling_threshold = internal_const_val("Weird::sampling_threshold")->AsCount();
|
weird_sampling_threshold = internal_val("Weird::sampling_threshold")->AsCount();
|
||||||
weird_sampling_duration = internal_const_val("Weird::sampling_duration")->AsInterval();
|
weird_sampling_duration = internal_val("Weird::sampling_duration")->AsInterval();
|
||||||
auto wl_val = internal_const_val("Weird::sampling_whitelist")->AsTableVal();
|
auto wl_val = internal_val("Weird::sampling_whitelist")->AsTableVal();
|
||||||
auto wl_table = wl_val->AsTable();
|
auto wl_table = wl_val->AsTable();
|
||||||
|
|
||||||
HashKey* k;
|
HashKey* k;
|
||||||
|
|
|
||||||
|
|
@ -152,6 +152,87 @@ public:
|
||||||
const WeirdCountMap& GetWeirdsByType() const
|
const WeirdCountMap& GetWeirdsByType() const
|
||||||
{ return weird_count_by_type; }
|
{ return weird_count_by_type; }
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets the weird sampling whitelist.
|
||||||
|
*
|
||||||
|
* @param weird_sampling_whitelist New weird sampling whitelist.
|
||||||
|
*/
|
||||||
|
WeirdSet GetWeirdSamplingWhitelist() const
|
||||||
|
{
|
||||||
|
return weird_sampling_whitelist;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets the weird sampling whitelist.
|
||||||
|
*
|
||||||
|
* @param weird_sampling_whitelist New weird sampling whitelist.
|
||||||
|
*/
|
||||||
|
void SetWeirdSamplingWhitelist(const WeirdSet &weird_sampling_whitelist)
|
||||||
|
{
|
||||||
|
Reporter::weird_sampling_whitelist = weird_sampling_whitelist;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Gets the current weird sampling threshold.
|
||||||
|
*
|
||||||
|
* @return weird sampling threshold.
|
||||||
|
*/
|
||||||
|
uint64 GetWeirdSamplingThreshold() const
|
||||||
|
{
|
||||||
|
return weird_sampling_threshold;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets the current weird sampling threshold.
|
||||||
|
*
|
||||||
|
* @param weird_sampling_threshold New weird sampling threshold.
|
||||||
|
*/
|
||||||
|
void SetWeirdSamplingThreshold(uint64 weird_sampling_threshold)
|
||||||
|
{
|
||||||
|
Reporter::weird_sampling_threshold = weird_sampling_threshold;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Gets the current weird sampling rate.
|
||||||
|
*
|
||||||
|
* @return weird sampling rate.
|
||||||
|
*/
|
||||||
|
uint64 GetWeirdSamplingRate() const
|
||||||
|
{
|
||||||
|
return weird_sampling_rate;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets the weird sampling rate.
|
||||||
|
*
|
||||||
|
* @param weird_sampling_rate New weird sampling rate.
|
||||||
|
*/
|
||||||
|
void SetWeirdSamplingRate(uint64 weird_sampling_rate)
|
||||||
|
{
|
||||||
|
Reporter::weird_sampling_rate = weird_sampling_rate;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Gets the current weird sampling duration.
|
||||||
|
*
|
||||||
|
* @return weird sampling duration.
|
||||||
|
*/
|
||||||
|
double GetWeirdSamplingDuration() const
|
||||||
|
{
|
||||||
|
return weird_sampling_duration;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets the current weird sampling duration. Please note that
|
||||||
|
* this will not delete already running timers.
|
||||||
|
*
|
||||||
|
* @param weird_sampling_duration New weird sampling duration.
|
||||||
|
*/
|
||||||
|
void SetWeirdSamplingDuration(double weird_sampling_duration)
|
||||||
|
{
|
||||||
|
Reporter::weird_sampling_duration = weird_sampling_duration;
|
||||||
|
}
|
||||||
|
|
||||||
private:
|
private:
|
||||||
void DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
|
void DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
|
||||||
Connection* conn, val_list* addl, bool location, bool time,
|
Connection* conn, val_list* addl, bool location, bool time,
|
||||||
|
|
@ -178,7 +259,6 @@ private:
|
||||||
|
|
||||||
uint64 weird_count;
|
uint64 weird_count;
|
||||||
WeirdCountMap weird_count_by_type;
|
WeirdCountMap weird_count_by_type;
|
||||||
|
|
||||||
WeirdCountMap net_weird_state;
|
WeirdCountMap net_weird_state;
|
||||||
WeirdFlowMap flow_weird_state;
|
WeirdFlowMap flow_weird_state;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -112,3 +112,102 @@ function Reporter::conn_weird%(name: string, c: connection, addl: string &defaul
|
||||||
reporter->Weird(c, name->CheckString(), addl->CheckString());
|
reporter->Weird(c, name->CheckString(), addl->CheckString());
|
||||||
return new Val(1, TYPE_BOOL);
|
return new Val(1, TYPE_BOOL);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
|
## Gets the weird sampling whitelist
|
||||||
|
##
|
||||||
|
## Returns: Current weird sampling whitelist
|
||||||
|
function Reporter::get_weird_sampling_whitelist%(%): string_set
|
||||||
|
%{
|
||||||
|
TableVal* set = new TableVal(string_set);
|
||||||
|
for ( auto el : reporter->GetWeirdSamplingWhitelist() )
|
||||||
|
{
|
||||||
|
set->Assign(new StringVal(el), nullptr);
|
||||||
|
}
|
||||||
|
return set;
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Sets the weird sampling whitelist
|
||||||
|
##
|
||||||
|
## whitelist: New weird sampling rate.
|
||||||
|
##
|
||||||
|
## Returns: Always true.
|
||||||
|
function Reporter::set_weird_sampling_whitelist%(weird_sampling_whitelist: string_set%) : bool
|
||||||
|
%{
|
||||||
|
auto wl_val = weird_sampling_whitelist->AsTableVal();
|
||||||
|
auto wl_table = wl_val->AsTable();
|
||||||
|
std::unordered_set<std::string> whitelist_set;
|
||||||
|
|
||||||
|
HashKey* k;
|
||||||
|
IterCookie* c = wl_table->InitForIteration();
|
||||||
|
TableEntryVal* v;
|
||||||
|
|
||||||
|
while ( (v = wl_table->NextEntry(k, c)) )
|
||||||
|
{
|
||||||
|
auto index = wl_val->RecoverIndex(k);
|
||||||
|
string key = index->Index(0)->AsString()->CheckString();
|
||||||
|
whitelist_set.emplace(move(key));
|
||||||
|
Unref(index);
|
||||||
|
delete k;
|
||||||
|
}
|
||||||
|
reporter->SetWeirdSamplingWhitelist(whitelist_set);
|
||||||
|
return new Val(1, TYPE_BOOL);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Gets the current weird sampling threshold
|
||||||
|
##
|
||||||
|
## Returns: current weird sampling threshold.
|
||||||
|
function Reporter::get_weird_sampling_threshold%(%) : count
|
||||||
|
%{
|
||||||
|
return new Val(reporter->GetWeirdSamplingThreshold(), TYPE_COUNT);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Sets the current weird sampling threshold
|
||||||
|
##
|
||||||
|
## threshold: New weird sampling threshold.
|
||||||
|
##
|
||||||
|
## Returns: Always returns true;
|
||||||
|
function Reporter::set_weird_sampling_threshold%(weird_sampling_threshold: count%) : bool
|
||||||
|
%{
|
||||||
|
reporter->SetWeirdSamplingThreshold(weird_sampling_threshold);
|
||||||
|
return new Val(1, TYPE_BOOL);
|
||||||
|
%}
|
||||||
|
|
||||||
|
|
||||||
|
## Gets the current weird sampling rate.
|
||||||
|
##
|
||||||
|
## Returns: weird sampling rate.
|
||||||
|
function Reporter::get_weird_sampling_rate%(%) : count
|
||||||
|
%{
|
||||||
|
return new Val(reporter->GetWeirdSamplingRate(), TYPE_COUNT);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Sets the weird sampling rate.
|
||||||
|
##
|
||||||
|
## weird_sampling_rate: New weird sampling rate.
|
||||||
|
##
|
||||||
|
## Returns: Always returns true.
|
||||||
|
function Reporter::set_weird_sampling_rate%(weird_sampling_rate: count%) : bool
|
||||||
|
%{
|
||||||
|
reporter->SetWeirdSamplingRate(weird_sampling_rate);
|
||||||
|
return new Val(1, TYPE_BOOL);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Gets the current weird sampling duration.
|
||||||
|
##
|
||||||
|
## Returns: weird sampling duration.
|
||||||
|
function Reporter::get_weird_sampling_duration%(%) : interval
|
||||||
|
%{
|
||||||
|
return new Val(reporter->GetWeirdSamplingDuration(), TYPE_INTERVAL);
|
||||||
|
%}
|
||||||
|
|
||||||
|
## Sets the current weird sampling duration. Please note that
|
||||||
|
## this will not delete already running timers.
|
||||||
|
##
|
||||||
|
## weird_sampling_duration: New weird sampling duration.
|
||||||
|
##
|
||||||
|
## Returns: always returns True
|
||||||
|
function Reporter::set_weird_sampling_duration%(weird_sampling_duration: interval%) : bool
|
||||||
|
%{
|
||||||
|
reporter->SetWeirdSamplingDuration(weird_sampling_duration);
|
||||||
|
return new Val(1, TYPE_BOOL);
|
||||||
|
%}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
#separator \x09
|
||||||
|
#set_separator ,
|
||||||
|
#empty_field (empty)
|
||||||
|
#unset_field -
|
||||||
|
#path config
|
||||||
|
#open 2018-09-05-19-30-42
|
||||||
|
#fields ts id old_value new_value location
|
||||||
|
#types time string string string string
|
||||||
|
0.000000 Weird::sampling_duration 10.0 mins 5.0 secs -
|
||||||
|
0.000000 Weird::sampling_threshold 25 10 -
|
||||||
|
0.000000 Weird::sampling_rate 1000 10 -
|
||||||
|
0.000000 Weird::sampling_whitelist (empty) whitelisted_net_weird,whitelisted_flow_weird,whitelisted_conn_weird -
|
||||||
|
#close 2018-09-05-19-30-42
|
||||||
|
|
@ -0,0 +1,360 @@
|
||||||
|
Config values set
|
||||||
|
{
|
||||||
|
whitelisted_net_weird,
|
||||||
|
whitelisted_flow_weird,
|
||||||
|
whitelisted_conn_weird
|
||||||
|
}
|
||||||
|
10
|
||||||
|
10
|
||||||
|
5.0
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
|
net_weird, my_net_weird
|
||||||
|
flow_weird, my_flow_weird
|
||||||
|
conn_weird, my_conn_weird
|
||||||
|
net_weird, whitelisted_net_weird
|
||||||
|
flow_weird, whitelisted_flow_weird
|
||||||
|
conn_weird, whitelisted_conn_weird
|
||||||
66
testing/btest/scripts/base/frameworks/config/weird.bro
Normal file
66
testing/btest/scripts/base/frameworks/config/weird.bro
Normal file
|
|
@ -0,0 +1,66 @@
|
||||||
|
# @TEST-EXEC: bro -r $TRACES/http/bro.org.pcap %INPUT >output
|
||||||
|
# @TEST-EXEC: btest-diff output
|
||||||
|
# @TEST-EXEC: btest-diff config.log
|
||||||
|
|
||||||
|
event bro_init()
|
||||||
|
{
|
||||||
|
Config::set_value("Weird::sampling_duration", 5sec);
|
||||||
|
Config::set_value("Weird::sampling_threshold", 10);
|
||||||
|
Config::set_value("Weird::sampling_rate", 10);
|
||||||
|
Config::set_value("Weird::sampling_whitelist", set("whitelisted_net_weird", "whitelisted_flow_weird", "whitelisted_conn_weird"));
|
||||||
|
print "Config values set";
|
||||||
|
}
|
||||||
|
|
||||||
|
event bro_init() &priority = -10
|
||||||
|
{
|
||||||
|
print Reporter::get_weird_sampling_whitelist();
|
||||||
|
print Reporter::get_weird_sampling_rate();
|
||||||
|
print Reporter::get_weird_sampling_threshold();
|
||||||
|
print Reporter::get_weird_sampling_duration();
|
||||||
|
}
|
||||||
|
|
||||||
|
event conn_weird(name: string, c: connection, addl: string)
|
||||||
|
{
|
||||||
|
print "conn_weird", name;
|
||||||
|
}
|
||||||
|
|
||||||
|
event flow_weird(name: string, src: addr, dst: addr)
|
||||||
|
{
|
||||||
|
print "flow_weird", name;
|
||||||
|
}
|
||||||
|
|
||||||
|
event net_weird(name: string)
|
||||||
|
{
|
||||||
|
print "net_weird", name;
|
||||||
|
}
|
||||||
|
|
||||||
|
event gen_weirds(c: connection)
|
||||||
|
{
|
||||||
|
local num = 30;
|
||||||
|
|
||||||
|
while ( num != 0 )
|
||||||
|
{
|
||||||
|
Reporter::net_weird("my_net_weird");
|
||||||
|
Reporter::flow_weird("my_flow_weird", c$id$orig_h, c$id$resp_h);
|
||||||
|
Reporter::conn_weird("my_conn_weird", c);
|
||||||
|
|
||||||
|
Reporter::net_weird("whitelisted_net_weird");
|
||||||
|
Reporter::flow_weird("whitelisted_flow_weird", c$id$orig_h, c$id$resp_h);
|
||||||
|
Reporter::conn_weird("whitelisted_conn_weird", c);
|
||||||
|
--num;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
global did_one_connection = F;
|
||||||
|
|
||||||
|
event new_connection(c: connection)
|
||||||
|
{
|
||||||
|
if ( did_one_connection )
|
||||||
|
return;
|
||||||
|
|
||||||
|
did_one_connection = T;
|
||||||
|
event gen_weirds(c); # should permit 10 + 2 of each "my" weird
|
||||||
|
schedule 2sec { gen_weirds(c) }; # should permit 3 of each "my" weird
|
||||||
|
schedule 7sec { gen_weirds(c) }; # should permit 10 + 2 of each "my" weird
|
||||||
|
# Total of 27 "my" weirds of each type and 90 of each "whitelisted" type
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue