mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Weird settings: make constants into options.
The new weird settings are now all updateable during runtime.
This commit is contained in:
Johanna Amann
parent
5c68093bc3
commit
bec98b98f3
9 changed files with 675 additions and 12 deletions
|
|
@ -1,2 +1,3 @@
|
|||
@load ./main
|
||||
@load ./input
|
||||
@load ./weird
|
||||
|
|
|
|||
44
scripts/base/frameworks/config/weird.bro
Normal file
44
scripts/base/frameworks/config/weird.bro
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
##! This script sets up the config framework change handlers for weirds.
|
||||
|
||||
@load ./main
|
||||
|
||||
module Config;
|
||||
|
||||
function weird_option_change_sampling_whitelist(ID: string, new_value: string_set, location: string) : string_set
|
||||
{
|
||||
if ( ID == "Weird::sampling_whitelist" )
|
||||
{
|
||||
Reporter::set_weird_sampling_whitelist(new_value);
|
||||
}
|
||||
return new_value;
|
||||
}
|
||||
|
||||
function weird_option_change_count(ID: string, new_value: count, location: string) : count
|
||||
{
|
||||
if ( ID == "Weird::sampling_threshold" )
|
||||
{
|
||||
Reporter::set_weird_sampling_threshold(new_value);
|
||||
}
|
||||
else if ( ID == "Weird::sampling_rate" )
|
||||
{
|
||||
Reporter::set_weird_sampling_rate(new_value);
|
||||
}
|
||||
return new_value;
|
||||
}
|
||||
|
||||
function weird_option_change_interval(ID: string, new_value: interval, location: string) : interval
|
||||
{
|
||||
if ( ID == "Weird::sampling_duration" )
|
||||
{
|
||||
Reporter::set_weird_sampling_duration(new_value);
|
||||
}
|
||||
return new_value;
|
||||
}
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Option::set_change_handler("Weird::sampling_whitelist", weird_option_change_sampling_whitelist, 5);
|
||||
Option::set_change_handler("Weird::sampling_threshold", weird_option_change_count, 5);
|
||||
Option::set_change_handler("Weird::sampling_rate", weird_option_change_count, 5);
|
||||
Option::set_change_handler("Weird::sampling_duration", weird_option_change_interval, 5);
|
||||
}
|
||||
|
|
@ -4847,18 +4847,18 @@ export {
|
|||
module Weird;
|
||||
export {
|
||||
## Prevents rate-limiting sampling of any weirds named in the table.
|
||||
const sampling_whitelist: set[string] &redef;
|
||||
option sampling_whitelist: set[string] = {};
|
||||
|
||||
## How many weirds of a given type to tolerate before sampling begins.
|
||||
## I.e. this many consecutive weirds of a given type will be allowed to
|
||||
## raise events for script-layer handling before being rate-limited.
|
||||
const sampling_threshold = 25 &redef;
|
||||
option sampling_threshold : count = 25;
|
||||
|
||||
## The rate-limiting sampling rate. One out of every of this number of
|
||||
## rate-limited weirds of a given type will be allowed to raise events
|
||||
## for further script-layer handling. Setting the sampling rate to 0
|
||||
## will disable all output of rate-limited weirds.
|
||||
const sampling_rate = 1000 &redef;
|
||||
option sampling_rate : count = 1000;
|
||||
|
||||
## How long a weird of a given type is allowed to keep state/counters in
|
||||
## memory. For "net" weirds an expiration timer starts per weird name when
|
||||
|
|
@ -4871,7 +4871,7 @@ export {
|
|||
## begins for "foo" and upon triggering will reset the counter for "foo"
|
||||
## and unthrottle its rate-limiting until it once again exceeds the
|
||||
## threshold.
|
||||
const sampling_duration = 10min &redef;
|
||||
option sampling_duration = 10min;
|
||||
}
|
||||
|
||||
module GLOBAL;
|
||||
|
|
|
|||
|
|
@ -52,13 +52,13 @@ Reporter::~Reporter()
|
|||
|
||||
void Reporter::InitOptions()
|
||||
{
|
||||
info_to_stderr = internal_const_val("Reporter::info_to_stderr")->AsBool();
|
||||
warnings_to_stderr = internal_const_val("Reporter::warnings_to_stderr")->AsBool();
|
||||
errors_to_stderr = internal_const_val("Reporter::errors_to_stderr")->AsBool();
|
||||
weird_sampling_rate = internal_const_val("Weird::sampling_rate")->AsCount();
|
||||
weird_sampling_threshold = internal_const_val("Weird::sampling_threshold")->AsCount();
|
||||
weird_sampling_duration = internal_const_val("Weird::sampling_duration")->AsInterval();
|
||||
auto wl_val = internal_const_val("Weird::sampling_whitelist")->AsTableVal();
|
||||
info_to_stderr = internal_val("Reporter::info_to_stderr")->AsBool();
|
||||
warnings_to_stderr = internal_val("Reporter::warnings_to_stderr")->AsBool();
|
||||
errors_to_stderr = internal_val("Reporter::errors_to_stderr")->AsBool();
|
||||
weird_sampling_rate = internal_val("Weird::sampling_rate")->AsCount();
|
||||
weird_sampling_threshold = internal_val("Weird::sampling_threshold")->AsCount();
|
||||
weird_sampling_duration = internal_val("Weird::sampling_duration")->AsInterval();
|
||||
auto wl_val = internal_val("Weird::sampling_whitelist")->AsTableVal();
|
||||
auto wl_table = wl_val->AsTable();
|
||||
|
||||
HashKey* k;
|
||||
|
|
|
|||
|
|
@ -152,6 +152,87 @@ public:
|
|||
const WeirdCountMap& GetWeirdsByType() const
|
||||
{ return weird_count_by_type; }
|
||||
|
||||
/**
|
||||
* Sets the weird sampling whitelist.
|
||||
*
|
||||
* @param weird_sampling_whitelist New weird sampling whitelist.
|
||||
*/
|
||||
WeirdSet GetWeirdSamplingWhitelist() const
|
||||
{
|
||||
return weird_sampling_whitelist;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the weird sampling whitelist.
|
||||
*
|
||||
* @param weird_sampling_whitelist New weird sampling whitelist.
|
||||
*/
|
||||
void SetWeirdSamplingWhitelist(const WeirdSet &weird_sampling_whitelist)
|
||||
{
|
||||
Reporter::weird_sampling_whitelist = weird_sampling_whitelist;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the current weird sampling threshold.
|
||||
*
|
||||
* @return weird sampling threshold.
|
||||
*/
|
||||
uint64 GetWeirdSamplingThreshold() const
|
||||
{
|
||||
return weird_sampling_threshold;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the current weird sampling threshold.
|
||||
*
|
||||
* @param weird_sampling_threshold New weird sampling threshold.
|
||||
*/
|
||||
void SetWeirdSamplingThreshold(uint64 weird_sampling_threshold)
|
||||
{
|
||||
Reporter::weird_sampling_threshold = weird_sampling_threshold;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the current weird sampling rate.
|
||||
*
|
||||
* @return weird sampling rate.
|
||||
*/
|
||||
uint64 GetWeirdSamplingRate() const
|
||||
{
|
||||
return weird_sampling_rate;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the weird sampling rate.
|
||||
*
|
||||
* @param weird_sampling_rate New weird sampling rate.
|
||||
*/
|
||||
void SetWeirdSamplingRate(uint64 weird_sampling_rate)
|
||||
{
|
||||
Reporter::weird_sampling_rate = weird_sampling_rate;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the current weird sampling duration.
|
||||
*
|
||||
* @return weird sampling duration.
|
||||
*/
|
||||
double GetWeirdSamplingDuration() const
|
||||
{
|
||||
return weird_sampling_duration;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the current weird sampling duration. Please note that
|
||||
* this will not delete already running timers.
|
||||
*
|
||||
* @param weird_sampling_duration New weird sampling duration.
|
||||
*/
|
||||
void SetWeirdSamplingDuration(double weird_sampling_duration)
|
||||
{
|
||||
Reporter::weird_sampling_duration = weird_sampling_duration;
|
||||
}
|
||||
|
||||
private:
|
||||
void DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
|
||||
Connection* conn, val_list* addl, bool location, bool time,
|
||||
|
|
@ -178,7 +259,6 @@ private:
|
|||
|
||||
uint64 weird_count;
|
||||
WeirdCountMap weird_count_by_type;
|
||||
|
||||
WeirdCountMap net_weird_state;
|
||||
WeirdFlowMap flow_weird_state;
|
||||
|
||||
|
|
|
|||
|
|
@ -112,3 +112,102 @@ function Reporter::conn_weird%(name: string, c: connection, addl: string &defaul
|
|||
reporter->Weird(c, name->CheckString(), addl->CheckString());
|
||||
return new Val(1, TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Gets the weird sampling whitelist
|
||||
##
|
||||
## Returns: Current weird sampling whitelist
|
||||
function Reporter::get_weird_sampling_whitelist%(%): string_set
|
||||
%{
|
||||
TableVal* set = new TableVal(string_set);
|
||||
for ( auto el : reporter->GetWeirdSamplingWhitelist() )
|
||||
{
|
||||
set->Assign(new StringVal(el), nullptr);
|
||||
}
|
||||
return set;
|
||||
%}
|
||||
|
||||
## Sets the weird sampling whitelist
|
||||
##
|
||||
## whitelist: New weird sampling rate.
|
||||
##
|
||||
## Returns: Always true.
|
||||
function Reporter::set_weird_sampling_whitelist%(weird_sampling_whitelist: string_set%) : bool
|
||||
%{
|
||||
auto wl_val = weird_sampling_whitelist->AsTableVal();
|
||||
auto wl_table = wl_val->AsTable();
|
||||
std::unordered_set<std::string> whitelist_set;
|
||||
|
||||
HashKey* k;
|
||||
IterCookie* c = wl_table->InitForIteration();
|
||||
TableEntryVal* v;
|
||||
|
||||
while ( (v = wl_table->NextEntry(k, c)) )
|
||||
{
|
||||
auto index = wl_val->RecoverIndex(k);
|
||||
string key = index->Index(0)->AsString()->CheckString();
|
||||
whitelist_set.emplace(move(key));
|
||||
Unref(index);
|
||||
delete k;
|
||||
}
|
||||
reporter->SetWeirdSamplingWhitelist(whitelist_set);
|
||||
return new Val(1, TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Gets the current weird sampling threshold
|
||||
##
|
||||
## Returns: current weird sampling threshold.
|
||||
function Reporter::get_weird_sampling_threshold%(%) : count
|
||||
%{
|
||||
return new Val(reporter->GetWeirdSamplingThreshold(), TYPE_COUNT);
|
||||
%}
|
||||
|
||||
## Sets the current weird sampling threshold
|
||||
##
|
||||
## threshold: New weird sampling threshold.
|
||||
##
|
||||
## Returns: Always returns true;
|
||||
function Reporter::set_weird_sampling_threshold%(weird_sampling_threshold: count%) : bool
|
||||
%{
|
||||
reporter->SetWeirdSamplingThreshold(weird_sampling_threshold);
|
||||
return new Val(1, TYPE_BOOL);
|
||||
%}
|
||||
|
||||
|
||||
## Gets the current weird sampling rate.
|
||||
##
|
||||
## Returns: weird sampling rate.
|
||||
function Reporter::get_weird_sampling_rate%(%) : count
|
||||
%{
|
||||
return new Val(reporter->GetWeirdSamplingRate(), TYPE_COUNT);
|
||||
%}
|
||||
|
||||
## Sets the weird sampling rate.
|
||||
##
|
||||
## weird_sampling_rate: New weird sampling rate.
|
||||
##
|
||||
## Returns: Always returns true.
|
||||
function Reporter::set_weird_sampling_rate%(weird_sampling_rate: count%) : bool
|
||||
%{
|
||||
reporter->SetWeirdSamplingRate(weird_sampling_rate);
|
||||
return new Val(1, TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Gets the current weird sampling duration.
|
||||
##
|
||||
## Returns: weird sampling duration.
|
||||
function Reporter::get_weird_sampling_duration%(%) : interval
|
||||
%{
|
||||
return new Val(reporter->GetWeirdSamplingDuration(), TYPE_INTERVAL);
|
||||
%}
|
||||
|
||||
## Sets the current weird sampling duration. Please note that
|
||||
## this will not delete already running timers.
|
||||
##
|
||||
## weird_sampling_duration: New weird sampling duration.
|
||||
##
|
||||
## Returns: always returns True
|
||||
function Reporter::set_weird_sampling_duration%(weird_sampling_duration: interval%) : bool
|
||||
%{
|
||||
reporter->SetWeirdSamplingDuration(weird_sampling_duration);
|
||||
return new Val(1, TYPE_BOOL);
|
||||
%}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,13 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path config
|
||||
#open 2018-09-05-19-30-42
|
||||
#fields ts id old_value new_value location
|
||||
#types time string string string string
|
||||
0.000000 Weird::sampling_duration 10.0 mins 5.0 secs -
|
||||
0.000000 Weird::sampling_threshold 25 10 -
|
||||
0.000000 Weird::sampling_rate 1000 10 -
|
||||
0.000000 Weird::sampling_whitelist (empty) whitelisted_net_weird,whitelisted_flow_weird,whitelisted_conn_weird -
|
||||
#close 2018-09-05-19-30-42
|
||||
|
|
@ -0,0 +1,360 @@
|
|||
Config values set
|
||||
{
|
||||
whitelisted_net_weird,
|
||||
whitelisted_flow_weird,
|
||||
whitelisted_conn_weird
|
||||
}
|
||||
10
|
||||
10
|
||||
5.0
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
66
testing/btest/scripts/base/frameworks/config/weird.bro
Normal file
66
testing/btest/scripts/base/frameworks/config/weird.bro
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/bro.org.pcap %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff config.log
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Config::set_value("Weird::sampling_duration", 5sec);
|
||||
Config::set_value("Weird::sampling_threshold", 10);
|
||||
Config::set_value("Weird::sampling_rate", 10);
|
||||
Config::set_value("Weird::sampling_whitelist", set("whitelisted_net_weird", "whitelisted_flow_weird", "whitelisted_conn_weird"));
|
||||
print "Config values set";
|
||||
}
|
||||
|
||||
event bro_init() &priority = -10
|
||||
{
|
||||
print Reporter::get_weird_sampling_whitelist();
|
||||
print Reporter::get_weird_sampling_rate();
|
||||
print Reporter::get_weird_sampling_threshold();
|
||||
print Reporter::get_weird_sampling_duration();
|
||||
}
|
||||
|
||||
event conn_weird(name: string, c: connection, addl: string)
|
||||
{
|
||||
print "conn_weird", name;
|
||||
}
|
||||
|
||||
event flow_weird(name: string, src: addr, dst: addr)
|
||||
{
|
||||
print "flow_weird", name;
|
||||
}
|
||||
|
||||
event net_weird(name: string)
|
||||
{
|
||||
print "net_weird", name;
|
||||
}
|
||||
|
||||
event gen_weirds(c: connection)
|
||||
{
|
||||
local num = 30;
|
||||
|
||||
while ( num != 0 )
|
||||
{
|
||||
Reporter::net_weird("my_net_weird");
|
||||
Reporter::flow_weird("my_flow_weird", c$id$orig_h, c$id$resp_h);
|
||||
Reporter::conn_weird("my_conn_weird", c);
|
||||
|
||||
Reporter::net_weird("whitelisted_net_weird");
|
||||
Reporter::flow_weird("whitelisted_flow_weird", c$id$orig_h, c$id$resp_h);
|
||||
Reporter::conn_weird("whitelisted_conn_weird", c);
|
||||
--num;
|
||||
}
|
||||
}
|
||||
|
||||
global did_one_connection = F;
|
||||
|
||||
event new_connection(c: connection)
|
||||
{
|
||||
if ( did_one_connection )
|
||||
return;
|
||||
|
||||
did_one_connection = T;
|
||||
event gen_weirds(c); # should permit 10 + 2 of each "my" weird
|
||||
schedule 2sec { gen_weirds(c) }; # should permit 3 of each "my" weird
|
||||
schedule 7sec { gen_weirds(c) }; # should permit 10 + 2 of each "my" weird
|
||||
# Total of 27 "my" weirds of each type and 90 of each "whitelisted" type
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue