Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'master' into topic/jsiwek/filter-rotation

Browse source
This commit is contained in:
Jon Siwek 2011-09-07 12:30:47 -05:00
commit d2bf33ee19
161 changed files with 1345 additions and 946 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/frameworks/cluster/main.bro
View file

@ -3,7 +3,8 @@
module Cluster;
export {
redef enum Log::ID += { CLUSTER };
redef enum Log::ID += { LOG };
type Info: record {
ts: time;
message: string;
@ -106,5 +107,5 @@ event bro_init() &priority=5
terminate();
}
Log::create_stream(CLUSTER, [$columns=Info]);
Log::create_stream(Cluster::LOG, [$columns=Info]);
}

7
scripts/base/frameworks/cluster/nodes/worker.bro
View file

@ -22,10 +22,5 @@ redef record_all_packets = T;
# do remote logging since we forward the notice event directly.
event bro_init()
{
Log::add_filter(Notice::NOTICE,
[
$name="cluster-worker",
$pred=function(rec: Notice::Info): bool { return F; }
]
);
Log::disable_stream(Notice::LOG);
}

34
scripts/base/frameworks/communication/main.bro
View file

@ -6,7 +6,7 @@
module Communication;
export {
redef enum Log::ID += { COMMUNICATION };
redef enum Log::ID += { LOG };
const default_port_ssl = 47756/tcp &redef;
const default_port_clear = 47757/tcp &redef;
@ -107,21 +107,18 @@ const src_names = {
[REMOTE_SRC_SCRIPT] = "script",
};
event bro_init()
event bro_init() &priority=5
{
Log::create_stream(COMMUNICATION, [$columns=Info]);
if ( |nodes| > 0 )
enable_communication();
Log::create_stream(Communication::LOG, [$columns=Info]);
}
function do_script_log_common(level: count, src: count, msg: string)
{
Log::write(COMMUNICATION, [$ts = network_time(),
$level = (level == REMOTE_LOG_INFO ? "info" : "error"),
$src_name = src_names[src],
$peer = get_event_peer()$descr,
$message = msg]);
Log::write(Communication::LOG, [$ts = network_time(),
$level = (level == REMOTE_LOG_INFO ? "info" : "error"),
$src_name = src_names[src],
$peer = get_event_peer()$descr,
$message = msg]);
}
# This is a core generated event.
@ -147,9 +144,9 @@ function connect_peer(peer: string)
local id = connect(node$host, p, class, node$retry, node$ssl);
if ( id == PEER_ID_NONE )
Log::write(COMMUNICATION, [$ts = network_time(),
$peer = get_event_peer()$descr,
$message = "can't trigger connect"]);
Log::write(Communication::LOG, [$ts = network_time(),
$peer = get_event_peer()$descr,
$message = "can't trigger connect"]);
pending_peers[id] = node;
}
@ -275,15 +272,18 @@ event remote_state_inconsistency(operation: string, id: string,
local msg = fmt("state inconsistency: %s should be %s but is %s before %s",
id, expected_old, real_old, operation);
Log::write(COMMUNICATION, [$ts = network_time(),
$peer = get_event_peer()$descr,
$message = msg]);
Log::write(Communication::LOG, [$ts = network_time(),
$peer = get_event_peer()$descr,
$message = msg]);
}
# Actually initiate the connections that need to be established.
event bro_init() &priority = -10 # let others modify nodes
{
if ( |nodes| > 0 )
enable_communication();
for ( tag in nodes )
{
if ( ! nodes[tag]$connect )

8
scripts/base/frameworks/dpd/main.bro
View file

@ -7,7 +7,7 @@ module DPD;
redef signature_files += "base/frameworks/dpd/dpd.sig";
export {
redef enum Log::ID += { DPD };
redef enum Log::ID += { LOG };
type Info: record {
## Timestamp for when protocol analysis failed.
@ -38,9 +38,9 @@ redef record connection += {
dpd: Info &optional;
};
event bro_init()
event bro_init() &priority=5
{
Log::create_stream(DPD, [$columns=Info]);
Log::create_stream(DPD::LOG, [$columns=Info]);
# Populate the internal DPD analysis variable.
for ( a in dpd_config )
@ -104,5 +104,5 @@ event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority=-5
{
if ( c?$dpd )
Log::write(DPD, c$dpd);
Log::write(DPD::LOG, c$dpd);
}

8
scripts/base/frameworks/intel/main.bro
View file

@ -25,7 +25,7 @@
module Intel;
export {
redef enum Log::ID += { INTEL };
redef enum Log::ID += { LOG };
redef enum Notice::Type += {
## This notice should be used in all detector scripts to indicate
@ -101,7 +101,7 @@ export {
event bro_init()
{
Log::create_stream(INTEL, [$columns=Info]);
Log::create_stream(Intel::LOG, [$columns=Info]);
}
@ -163,7 +163,7 @@ function insert(item: Item): bool
}
if ( err_msg != "" )
Log::write(INTEL, [$ts=network_time(), $level="warn", $message=fmt(err_msg)]);
Log::write(Intel::LOG, [$ts=network_time(), $level="warn", $message=fmt(err_msg)]);
return F;
}
@ -272,6 +272,6 @@ function matcher(item: QueryItem): bool
}
if ( err_msg != "" )
Log::write(INTEL, [$ts=network_time(), $level="error", $message=fmt(err_msg)]);
Log::write(Intel::LOG, [$ts=network_time(), $level="error", $message=fmt(err_msg)]);
return F;
}

45
scripts/base/frameworks/logging/main.bro
View file

@ -177,8 +177,47 @@ function __default_rotation_postprocessor(info: RotationInfo) : bool
function default_path_func(id: ID, path: string, rec: any) : string
{
# TODO for Seth: Do what you want. :)
return path;
local id_str = fmt("%s", id);
local parts = split1(id_str, /::/);
if ( |parts| == 2 )
{
# TODO: the core shouldn't be suggesting paths anymore. Only
# statically defined paths should be sent into here. This
# is only to cope with the core generated paths.
if ( to_lower(parts[2]) != path )
return path;
# Example: Notice::LOG -> "notice"
if ( parts[2] == "LOG" )
{
local module_parts = split_n(parts[1], /[^A-Z][A-Z][a-z]*/, T, 4);
local output = "";
if ( 1 in module_parts )
output = module_parts[1];
if ( 2 in module_parts && module_parts[2] != "" )
output = cat(output, sub_bytes(module_parts[2],1,1), "_", sub_bytes(module_parts[2], 2, |module_parts[2]|));
if ( 3 in module_parts && module_parts[3] != "" )
output = cat(output, "_", module_parts[3]);
if ( 4 in module_parts && module_parts[4] != "" )
output = cat(output, sub_bytes(module_parts[4],1,1), "_", sub_bytes(module_parts[4], 2, |module_parts[4]|));
# TODO: There seems to be some problem with the split function
# not putting \0 at the end of the string. fmt will make
# a better internal string.
return fmt("%s", to_lower(output));
}
# Example: Notice::POLICY_LOG -> "notice_policy"
if ( /_LOG$/ in parts[2] )
parts[2] = sub(parts[2], /_LOG$/, "");
return cat(to_lower(parts[1]),"_",to_lower(parts[2]));
}
else
{
# In case there is a logging stream in the global namespace.
return to_lower(id_str);
}
}
# Run post-processor on file. If there isn't any postprocessor defined,
@ -222,7 +261,7 @@ function add_filter(id: ID, filter: Filter) : bool
# definition.
if ( ! filter?$path_func )
filter$path_func = default_path_func;
filters[id, filter$name] = filter;
return __add_filter(id, filter);
}

42
scripts/base/frameworks/logging/postprocessors/scp.bro Normal file
View file

@ -0,0 +1,42 @@
##! This script defines a postprocessing function that can be applied
##! to a logging filter in order to automatically SCP (secure copy)
##! a log stream (or a subset of it) to a remote host at configurable
##! rotation time intervals.
module Log;
export {
## This postprocessor SCP's the rotated-log to all the remote hosts
## defined in :bro:id:`Log::scp_destinations` and then deletes
## the local copy of the rotated-log. It's not active when
## reading from trace files.
global scp_postprocessor: function(info: Log::RotationInfo): bool;
## A container that describes the remote destination for the SCP command
## argument as ``user@host:path``.
type SCPDestination: record {
user: string;
host: string;
path: string;
};
## A table indexed by a particular log writer and filter path, that yields
## a set remote destinations. The :bro:id:`Log::scp_postprocessor`
## function queries this table upon log rotation and performs a secure
## copy of the rotated-log to each destination in the set.
global scp_destinations: table[Writer, string] of set[SCPDestination];
}
function scp_postprocessor(info: Log::RotationInfo): bool
{
if ( reading_traces() || [info$writer, info$path] !in scp_destinations )
return T;
local command = "";
for ( d in scp_destinations[info$writer, info$path] )
command += fmt("scp %s %s@%s:%s;", info$fname, d$user, d$host, d$path);
command += fmt("/bin/rm %s", info$fname);
system(command);
return T;
}

2
scripts/base/frameworks/logging/writers/ascii.bro
View file

@ -11,7 +11,7 @@ export {
const include_header = T &redef;
## Prefix for the header line if included.
const header_prefix = "# " &redef;
const header_prefix = "#" &redef;
## Separator between fields.
const separator = "\t" &redef;

6
scripts/base/frameworks/metrics/main.bro
View file

@ -5,7 +5,7 @@
module Metrics;
export {
redef enum Log::ID += { METRICS };
redef enum Log::ID += { LOG };
type ID: enum {
NOTHING,
@ -124,7 +124,7 @@ global thresholds: table[ID, string, Index] of count = {} &create_expire=renotic
event bro_init() &priority=5
{
Log::create_stream(METRICS, [$columns=Info, $ev=log_metrics]);
Log::create_stream(Metrics::LOG, [$columns=Info, $ev=log_metrics]);
}
function index2str(index: Index): string
@ -151,7 +151,7 @@ function write_log(ts: time, filter: Filter, data: MetricTable)
$value=val];
if ( filter$log )
Log::write(METRICS, m);
Log::write(Metrics::LOG, m);
}
}

117
scripts/base/frameworks/notice/main.bro
View file

@ -9,15 +9,13 @@ module Notice;
export {
redef enum Log::ID += {
## This is the primary logging stream for notices. It must always be
## referenced with the module name included because the name is
## also used by the global function :bro:id:`NOTICE`.
NOTICE,
## This is the primary logging stream for notices.
LOG,
## This is the notice policy auditing log. It records what the current
## notice policy is at Bro init time.
NOTICE_POLICY,
POLICY_LOG,
## This is the alarm stream.
ALARM,
ALARM_LOG,
};
## Scripts creating new notices need to redef this enum to add their own
@ -41,7 +39,9 @@ export {
## Indicates that the notice should be sent to the email address(es)
## configured in the :bro:id:`Notice::mail_dest` variable.
ACTION_EMAIL,
## Indicates that the notice should be alarmed.
## Indicates that the notice should be alarmed. A readable ASCII
## version of the alarm log is emailed in bulk to the address(es)
## configured in :bro:id:`Notice::mail_dest`.
ACTION_ALARM,
};
@ -136,7 +136,8 @@ export {
## Local system sendmail program.
const sendmail = "/usr/sbin/sendmail" &redef;
## Email address to send notices with the :bro:enum:`ACTION_EMAIL` action.
## Email address to send notices with the :bro:enum:`ACTION_EMAIL` action
## or to send bulk alarm logs on rotation with :bro:enum:`ACTION_ALARM`.
const mail_dest = "" &redef;
## Address that emails will be from.
@ -146,6 +147,11 @@ export {
## Text string prefixed to the subject of all emails sent out.
const mail_subject_prefix = "[Bro]" &redef;
## A log postprocessing function that implements emailing the contents
## of a log upon rotation to any configured :bro:id:`Notice::mail_dest`.
## The rotated log is removed upon being sent.
global log_mailing_postprocessor: function(info: Log::RotationInfo): bool;
## This is the event that is called as the entry point to the
## notice framework by the global :bro:id:`NOTICE` function. By the time
## this event is generated, default values have already been filled out in
@ -171,7 +177,14 @@ export {
## by default with the built in :bro:enum:`ACTION_EMAIL` and
## :bro:enum:`ACTION_PAGE` actions.
global email_notice_to: function(n: Info, dest: string, extend: bool);
## Constructs mail headers to which an email body can be appended for
## sending with sendmail.
## subject_desc: a subject string to use for the mail
## dest: recipient string to use for the mail
## Returns: a string of mail headers to which an email body can be appended
global email_headers: function(subject_desc: string, dest: string): string;
## This is an internally used function, please ignore it. It's only used
## for filling out missing details of :bro:type:`Notice:Info` records
## before the synchronous and asynchronous event pathways have begun.
@ -186,21 +199,48 @@ export {
# priority.
global ordered_policy: vector of PolicyItem = vector();
event bro_init()
function log_mailing_postprocessor(info: Log::RotationInfo): bool
{
Log::create_stream(NOTICE_POLICY, [$columns=PolicyItem]);
Log::create_stream(Notice::NOTICE, [$columns=Info, $ev=log_notice]);
Log::create_stream(ALARM, [$columns=Notice::Info]);
# Make sure that this log is output as text so that it can be packaged
# up and emailed later.
Log::add_filter(ALARM, [$name="default", $writer=Log::WRITER_ASCII]);
if ( ! reading_traces() && mail_dest != "" )
{
local headers = email_headers(fmt("Log Contents: %s", info$fname),
mail_dest);
local tmpfilename = fmt("%s.mailheaders.tmp", info$fname);
local tmpfile = open(tmpfilename);
write_file(tmpfile, headers);
close(tmpfile);
system(fmt("/bin/cat %s %s | %s -t -oi && /bin/rm %s %s",
tmpfilename, info$fname, sendmail, tmpfilename, info$fname));
}
return T;
}
# This extra export section here is just because this redefinition should
# be documented as part of the "public API" of this script, but the redef
# needs to occur after the postprocessor function implementation.
export {
## By default, an ASCII version of the the alarm log is emailed daily to any
## configured :bro:id:`Notice::mail_dest` if not operating on trace files.
redef Log::rotation_control += {
[Log::WRITER_ASCII, "alarm-mail"] =
[$interv=24hrs, $postprocessor=log_mailing_postprocessor]
};
}
event bro_init() &priority=5
{
Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice]);
Log::create_stream(Notice::POLICY_LOG, [$columns=PolicyItem]);
Log::create_stream(Notice::ALARM_LOG, [$columns=Notice::Info]);
# If Bro is configured for mailing notices, set up mailing for alarms.
# Make sure that this alarm log is also output as text so that it can
# be packaged up and emailed later.
if ( ! reading_traces() && mail_dest != "" )
Log::add_filter(Notice::ALARM_LOG, [$name="alarm-mail",
$path="alarm-mail",
$writer=Log::WRITER_ASCII]);
}
# TODO: need a way to call a Bro script level callback during file rotation.
# we need more than a just $postprocessor.
#redef Log::rotation_control += {
# [Log::WRITER_ASCII, "alarm"] = [$postprocessor="mail-alarms"];
#};
# TODO: fix this.
#function notice_tags(n: Notice::Info) : table[string] of string
@ -220,20 +260,24 @@ event bro_init()
# return tgs;
# }
function email_headers(subject_desc: string, dest: string): string
{
local header_text = string_cat(
"From: ", mail_from, "\n",
"Subject: ", mail_subject_prefix, " ", subject_desc, "\n",
"To: ", dest, "\n",
"User-Agent: Bro-IDS/", bro_version(), "\n");
if ( reply_to != "" )
header_text = string_cat(header_text, "Reply-To: ", reply_to, "\n");
return header_text;
}
function email_notice_to(n: Notice::Info, dest: string, extend: bool)
{
if ( reading_traces() || dest == "" )
return;
local email_text = string_cat(
"From: ", mail_from, "\n",
"Subject: ", mail_subject_prefix, " ", fmt("%s", n$note), "\n",
"To: ", dest, "\n",
# TODO: BiF to get version (the resource_usage Bif seems like overkill).
"User-Agent: Bro-IDS/?.?.?\n");
if ( reply_to != "" )
email_text = string_cat(email_text, "Reply-To: ", reply_to, "\n");
local email_text = email_headers(fmt("%s", n$note), dest);
# The notice emails always start off with the human readable message.
email_text = string_cat(email_text, "\n", n$msg, "\n");
@ -257,9 +301,9 @@ event notice(n: Notice::Info) &priority=-5
if ( ACTION_EMAIL in n$actions )
email_notice_to(n, mail_dest, T);
if ( ACTION_LOG in n$actions )
Log::write(Notice::NOTICE, n);
Log::write(Notice::LOG, n);
if ( ACTION_ALARM in n$actions )
Log::write(ALARM, n);
Log::write(Notice::ALARM_LOG, n);
}
# Executes a script with all of the notice fields put into the
@ -348,10 +392,7 @@ event bro_init() &priority=10
for ( pi in policy )
{
if ( pi$priority < 0 || pi$priority > 10 )
{
print "All Notice::PolicyItem priorities must be within 0 and 10";
exit();
}
Reporter::fatal("All Notice::PolicyItem priorities must be within 0 and 10");
if ( pi$priority !in tmp )
tmp[pi$priority] = set();
@ -368,7 +409,7 @@ event bro_init() &priority=10
{
pi$position = |ordered_policy|;
ordered_policy[|ordered_policy|] = pi;
Log::write(NOTICE_POLICY, pi);
Log::write(Notice::POLICY_LOG, pi);
}
}
}

8
scripts/base/frameworks/notice/weird.bro
View file

@ -5,7 +5,7 @@
module Weird;
export {
redef enum Log::ID += { WEIRD };
redef enum Log::ID += { LOG };
redef enum Notice::Type += {
## Generic unusual but alarm-worthy activity.
@ -259,9 +259,9 @@ global did_inconsistency_msg: set[conn_id];
# Used to pass the optional connection into report_weird().
global current_conn: connection;
event bro_init()
event bro_init() &priority=5
{
Log::create_stream(WEIRD, [$columns=Info, $ev=log_weird]);
Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird]);
}
function report_weird(t: time, name: string, id: string, have_conn: bool,
@ -311,7 +311,7 @@ function report_weird(t: time, name: string, id: string, have_conn: bool,
add weird_ignore[id][name];
}
Log::write(WEIRD, info);
Log::write(Weird::LOG, info);
}
function report_weird_conn(t: time, name: string, id: string, addl: string,

8
scripts/base/frameworks/packet-filter/main.bro
View file

@ -9,7 +9,7 @@
module PacketFilter;
export {
redef enum Log::ID += { PACKET_FILTER };
redef enum Log::ID += { LOG };
redef enum Notice::Type += {
## This notice is generated if a packet filter is unable to be compiled.
@ -121,7 +121,7 @@ function install()
NOTICE([$note=Compile_Failure,
$msg=fmt("Compiling packet filter failed"),
$sub=default_filter]);
exit();
Reporter::fatal(fmt("Bad pcap filter '%s'", default_filter));
}
# Do an audit log for the packet filter.
@ -144,11 +144,11 @@ function install()
$sub=default_filter]);
}
Log::write(PACKET_FILTER, info);
Log::write(PacketFilter::LOG, info);
}
event bro_init() &priority=10
{
Log::create_stream(PACKET_FILTER, [$columns=Info]);
Log::create_stream(PacketFilter::LOG, [$columns=Info]);
PacketFilter::install();
}

18
scripts/base/frameworks/reporter/main.bro
View file

@ -5,9 +5,13 @@
module Reporter;
export {
redef enum Log::ID += { REPORTER };
redef enum Log::ID += { LOG };
type Level: enum { INFO, WARNING, ERROR };
type Level: enum {
INFO,
WARNING,
ERROR
};
type Info: record {
ts: time &log;
@ -19,22 +23,22 @@ export {
};
}
event bro_init()
event bro_init() &priority=5
{
Log::create_stream(REPORTER, [$columns=Info]);
Log::create_stream(Reporter::LOG, [$columns=Info]);
}
event reporter_info(t: time, msg: string, location: string)
{
Log::write(REPORTER, [$ts=t, $level=INFO, $message=msg, $location=location]);
Log::write(Reporter::LOG, [$ts=t, $level=INFO, $message=msg, $location=location]);
}
event reporter_warning(t: time, msg: string, location: string)
{
Log::write(REPORTER, [$ts=t, $level=WARNING, $message=msg, $location=location]);
Log::write(Reporter::LOG, [$ts=t, $level=WARNING, $message=msg, $location=location]);
}
event reporter_error(t: time, msg: string, location: string)
{
Log::write(REPORTER, [$ts=t, $level=ERROR, $message=msg, $location=location]);
Log::write(Reporter::LOG, [$ts=t, $level=ERROR, $message=msg, $location=location]);
}

10
scripts/base/frameworks/signatures/main.bro
View file

@ -25,7 +25,7 @@ export {
Signature_Summary,
};
redef enum Log::ID += { SIGNATURES };
redef enum Log::ID += { LOG };
## These are the default actions you can apply to signature matches.
## All of them write the signature record to the logging stream unless
@ -114,7 +114,7 @@ global did_sig_log: set[string] &read_expire = 1 hr;
event bro_init()
{
Log::create_stream(SIGNATURES, [$columns=Info, $ev=log_signature]);
Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature]);
}
# Returns true if the given signature has already been triggered for the given
@ -174,7 +174,7 @@ event signature_match(state: signature_state, msg: string, data: string)
$event_msg=fmt("%s: %s", src_addr, msg),
$sig_id=sig_id,
$sub_msg=data];
Log::write(SIGNATURES, info);
Log::write(Signatures::LOG, info);
}
local notice = F;
@ -248,7 +248,7 @@ event signature_match(state: signature_state, msg: string, data: string)
fmt("%s has triggered signature %s on %d hosts",
orig, sig_id, hcount);
Log::write(SIGNATURES,
Log::write(Signatures::LOG,
[$note=Multiple_Sig_Responders,
$src_addr=orig, $sig_id=sig_id, $event_msg=msg,
$host_count=hcount, $sub_msg=horz_scan_msg]);
@ -265,7 +265,7 @@ event signature_match(state: signature_state, msg: string, data: string)
fmt("%s has triggered %d different signatures on host %s",
orig, vcount, resp);
Log::write(SIGNATURES,
Log::write(Signatures::LOG,
[$ts=network_time(),
$note=Multiple_Signatures,
$src_addr=orig,

6
scripts/base/frameworks/software/main.bro
View file

@ -11,7 +11,7 @@ module Software;
export {
redef enum Log::ID += { SOFTWARE };
redef enum Log::ID += { LOG };
type Type: enum {
UNKNOWN,
@ -103,7 +103,7 @@ export {
event bro_init()
{
Log::create_stream(SOFTWARE, [$columns=Info, $ev=log_software]);
Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software]);
}
function parse_mozilla(unparsed_version: string,
@ -379,7 +379,7 @@ event software_register(id: conn_id, info: Info)
return;
}
Log::write(SOFTWARE, info);
Log::write(Software::LOG, info);
ts[info$name] = info;
}