Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'master' into topic/jsiwek/broker

Browse source
This commit is contained in:
Jon Siwek 2015-02-16 10:00:17 -06:00
commit e95116ba85
26 changed files with 328 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/Baseline/plugins.writer/output
View file

@ -17,6 +17,6 @@ Demo::Foo - A Foo test logging writer (dynamic, version 1.0)
[http] 1340213020.732963|CjhGID4nQcgTWjvg4c|10.0.0.55|53994|60.190.189.214|8124|5|GET|www.osnews.com|/images/icons/17.gif|http://www.osnews.com/|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2|0|0|304|Not Modified|-|-|-||-|-|-|-|-|-|-
[http] 1340213021.300269|CjhGID4nQcgTWjvg4c|10.0.0.55|53994|60.190.189.214|8124|6|GET|www.osnews.com|/images/left.gif|http://www.osnews.com/|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2|0|0|304|Not Modified|-|-|-||-|-|-|-|-|-|-
[http] 1340213021.861584|CjhGID4nQcgTWjvg4c|10.0.0.55|53994|60.190.189.214|8124|7|GET|www.osnews.com|/images/icons/32.gif|http://www.osnews.com/|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2|0|0|304|Not Modified|-|-|-||-|-|-|-|-|-|-
[packet_filter] 1412721099.419280|bro|ip or not ip|T|T
[socks] 1340213015.276495|CjhGID4nQcgTWjvg4c|10.0.0.55|53994|60.190.189.214|8124|5|-|succeeded|-|www.osnews.com|80|192.168.0.31|-|2688
[packet_filter] 1423781675.402129|bro|ip or not ip|T|T
[socks] 1340213015.276495|CjhGID4nQcgTWjvg4c|10.0.0.55|53994|60.190.189.214|8124|5|-|-|succeeded|-|www.osnews.com|80|192.168.0.31|-|2688
[tunnel] 1340213015.276495|-|10.0.0.55|0|60.190.189.214|8124|Tunnel::SOCKS|Tunnel::DISCOVER

10
testing/btest/Baseline/scripts.base.frameworks.file-analysis.big-bof-buffer/files.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path files
#open 2015-02-05-13-55-41
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string
1362692527.009512 FakNcS1Jfe01uljb3 192.150.187.43 141.142.228.5 CXWv6p3arKYeMETxOg HTTP 0 MD5,SHA1 text/plain - 0.000263 - F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 - -
#close 2015-02-05-13-55-41

10
testing/btest/Baseline/scripts.base.protocols.socks.socks-auth/socks.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path socks
#open 2015-02-05-16-13-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version user password status request.host request.name request_p bound.host bound.name bound_p
#types time string addr port addr port count string string string addr string port addr string port
1368517392.724989 CXWv6p3arKYeMETxOg 192.168.0.2 55951 192.168.0.1 1080 5 bob alice succeeded 192.168.0.2 - 22 192.168.0.1 - 55951
#close 2015-02-05-16-13-12

10
testing/btest/Baseline/scripts.base.protocols.socks.socks-auth/tunnel.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path tunnel
#open 2015-02-05-16-13-12
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum
1368517392.728523 - 192.168.0.2 0 192.168.0.1 1080 Tunnel::SOCKS Tunnel::DISCOVER
#close 2015-02-05-16-13-12

10
testing/btest/Baseline/scripts.base.protocols.socks.trace1/socks.log
View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path socks
#open 2013-08-26-19-04-20
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version user status request.host request.name request_p bound.host bound.name bound_p
#types time string addr port addr port count string string addr string port addr string port
1340213015.276495 CjhGID4nQcgTWjvg4c 10.0.0.55 53994 60.190.189.214 8124 5 - succeeded - www.osnews.com 80 192.168.0.31 - 2688
#close 2013-08-26-19-04-20
#open 2015-02-05-17-39-14
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version user password status request.host request.name request_p bound.host bound.name bound_p
#types time string addr port addr port count string string string addr string port addr string port
1340213015.276495 CjhGID4nQcgTWjvg4c 10.0.0.55 53994 60.190.189.214 8124 5 - - succeeded - www.osnews.com 80 192.168.0.31 - 2688
#close 2015-02-05-17-39-14

10
testing/btest/Baseline/scripts.base.protocols.socks.trace2/socks.log
View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path socks
#open 2013-08-26-19-04-20
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version user status request.host request.name request_p bound.host bound.name bound_p
#types time string addr port addr port count string string addr string port addr string port
1340113261.914619 CXWv6p3arKYeMETxOg 10.0.0.50 59580 85.194.84.197 1080 5 - succeeded - www.google.com 443 0.0.0.0 - 443
#close 2013-08-26-19-04-20
#open 2015-02-05-17-39-29
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version user password status request.host request.name request_p bound.host bound.name bound_p
#types time string addr port addr port count string string string addr string port addr string port
1340113261.914619 CXWv6p3arKYeMETxOg 10.0.0.50 59580 85.194.84.197 1080 5 - - succeeded - www.google.com 443 0.0.0.0 - 443
#close 2015-02-05-17-39-29

BIN
testing/btest/Traces/socks-auth.pcap Normal file
View file

Binary file not shown.

6
testing/btest/scripts/base/frameworks/file-analysis/big-bof-buffer.bro Normal file
View file

@ -0,0 +1,6 @@
# @TEST-EXEC: bro -r $TRACES/http/get.trace %INPUT
# @TEST-EXEC: btest-diff files.log
@load frameworks/files/hash-all-files
redef default_file_bof_buffer_size=5000;

5
testing/btest/scripts/base/protocols/socks/socks-auth.bro Normal file
View file

@ -0,0 +1,5 @@
# @TEST-EXEC: bro -r $TRACES/socks-auth.pcap %INPUT
# @TEST-EXEC: btest-diff socks.log
# @TEST-EXEC: btest-diff tunnel.log
@load base/protocols/socks

30
testing/scripts/diff-remove-x509-names
View file

@ -3,19 +3,25 @@
# A diff canonifier that removes all X.509 Distinguished Name subject fields
# because that output can differ depending on installed OpenSSL version.
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1; cs_col = -1; ci_col = -1 }
BEGIN { FS="\t"; OFS="\t"; s_col = -1; i_col = -1; is_col = -1; cs_col = -1; ci_col = -1; cert_subj_col = -1; cert_issuer_col = -1 }
/^#fields/ {
for ( i = 2; i < NF; ++i )
{
if ( $i == "subject" )
s_col = i-1;
if ( $i == "issuer_subject" )
if ( $i == "issuer" )
i_col = i-1;
if ( $i == "issuer_subject" )
is_col = i-1;
if ( $i == "client_subject" )
cs_col = i-1;
if ( $i == "client_issuer_subject" )
if ( $i == "client_issuer" )
ci_col = i-1;
if ( $i == "certificate.subject" )
cert_subj_col = i-1;
if ( $i == "certificate.issuer" )
cert_issuer_col = i-1;
}
}
@ -31,6 +37,12 @@ i_col >= 0 {
$i_col = "+";
}
is_col >= 0 {
if ( $is_col != "-" )
# Mark that it's set, but ignore content.
$is_col = "+";
}
cs_col >= 0 {
if ( $cs_col != "-" )
# Mark that it's set, but ignore content.
@ -43,6 +55,18 @@ ci_col >= 0 {
$ci_col = "+";
}
cert_subj_col >= 0 {
if ( $cert_subj_col != "-" )
# Mark that it's set, but ignore content.
$cert_subj_col = "+";
}
cert_issuer_col >= 0 {
if ( $cert_issuer_col != "-" )
# Mark that it's set, but ignore content.
$cert_issuer_col = "+";
}
{
print;
}