Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Moved the packet segment logging into it's own script.

Browse source
This commit is contained in:
Seth Hall 2011-04-21 14:25:09 -04:00
parent 6275bc555d
commit e34d24df8f
3 changed files with 94 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

71
policy/dpd.bro
View file

@ -1,70 +1 @@
##! Activates port-independent protocol detection. @load dpd/base
@load functions
@load signatures
module DPD;
# Add the DPD signatures.
redef signature_files += "dpd.sig";
redef enum Log::ID += { DPD };
export {
type Info: record {
ts: time &log;
id: conn_id &log;
proto: transport_proto &log;
analyzer: string &log;
failure_reason: string &log;
packet_segment: string &log;
};
## Size of the packet segment to display in the DPD log.
const packet_segment_size: int = 255 &redef;
}
redef record connection += {
dpd: Info &optional;
};
event bro_init()
{
Log::create_stream(DPD, [$columns=Info]);
for ( a in dpd_config )
{
for ( p in dpd_config[a]$ports )
{
if ( p !in dpd_analyzer_ports )
dpd_analyzer_ports[p] = set();
add dpd_analyzer_ports[p][a];
}
}
}
event protocol_confirmation(c: connection, atype: count, aid: count) &priority=10
{
if ( fmt("-%s",analyzer_name(atype)) in c$service )
delete c$service[fmt("-%s", analyzer_name(atype))];
add c$service[analyzer_name(atype)];
}
event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority=10
{
if ( analyzer_name(atype) in c$service )
delete c$service[analyzer_name(atype)];
add c$service[fmt("-%s", analyzer_name(atype))];
# Get the content of the currently analyzed packet and trim it down to a shorter size
local packet_segment = sub_bytes(get_current_packet()$data, 0, packet_segment_size);
Log::write(DPD, [$ts=network_time(),
$id=c$id,
$proto=get_conn_transport_proto(c$id),
$analyzer=analyzer_name(atype),
$failure_reason=reason,
$packet_segment=fmt("%s", packet_segment)]);
}

70
policy/dpd/base.bro Normal file
View file

@ -0,0 +1,70 @@
##! Activates port-independent protocol detection.
@load functions
@load signatures
module DPD;
# Add the DPD signatures.
redef signature_files += "dpd.sig";
redef enum Log::ID += { DPD };
export {
type Info: record {
ts: time &log;
id: conn_id &log;
proto: transport_proto &log;
analyzer: string &log;
failure_reason: string &log;
};
}
redef record connection += {
dpd: Info &optional;
};
event bro_init()
{
Log::create_stream(DPD, [$columns=Info]);
for ( a in dpd_config )
{
for ( p in dpd_config[a]$ports )
{
if ( p !in dpd_analyzer_ports )
dpd_analyzer_ports[p] = set();
add dpd_analyzer_ports[p][a];
}
}
}
event protocol_confirmation(c: connection, atype: count, aid: count) &priority=10
{
if ( fmt("-%s",analyzer_name(atype)) in c$service )
delete c$service[fmt("-%s", analyzer_name(atype))];
add c$service[analyzer_name(atype)];
}
event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority=5
{
if ( analyzer_name(atype) in c$service )
delete c$service[analyzer_name(atype)];
add c$service[fmt("-%s", analyzer_name(atype))];
local info: Info;
info$ts=network_time();
info$id=c$id;
info$proto=get_conn_transport_proto(c$id);
info$analyzer=analyzer_name(atype);
info$failure_reason=reason;
c$dpd = info;
}
event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority=-5
{
Log::write(DPD, c$dpd);
}

23
policy/dpd/packet-segment-logging.bro Normal file
View file

@ -0,0 +1,23 @@
##! This script enables logging of packet segment data. The amount of
##! data from the packet logged is set by the packet_segment_size variable.
##! A caveat to logging packet data is that in some cases, the packet may
##! not be the packet that actually caused the protocol violation. For this
##! reason, this script should not be loaded by default in shipped scripts.
module DPD;
export {
redef record Info += {
packet_segment: string &optional &log;
};
## Size of the packet segment to display in the DPD log.
const packet_segment_size: int = 255 &redef;
}
event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority=4
{
c$dpd$packet_segment=fmt("%s", sub_bytes(get_current_packet()$data, 0, packet_segment_size));
}