Commit graph

95 commits

Author SHA1 Message Date
Robin Sommer
fe7e1ee7f0 Merge topic/actor-system throug a squashed commit. 2018-05-18 22:39:23 +00:00
Johanna Amann
db6f028003 Add config framework.
The configuration framework consists of three mostly distinct parts:

* option variables
* the config reader
* the script level framework

I will describe the three elements in the following.

Internally, this commit also performs a range of changes to the Input
manager; it marks a lot of functions as const and introduces a new
ValueToVal method (which could in theory replace the already existing
one - it is a bit more powerful).

This also changes SerialTypes to have a subtype for Values, just as
Fields already have it; I think it was mostly an oversight that this was
not introduced from the beginning. This should not necessitate any code
changes for people already using SerialTypes.

option variable
===============

The option keyword allows variables to be specified as run-tine options.
Such variables cannot be changed using normal assignments. Instead, they
can be changed using Option::set. It is possible to "subscribe" to
options and be notified when an option value changes.

Change handlers can also change values before they are applied; this
gives them the opportunity to reject changes. Priorities can be
specified if there are several handlers for one option.

Example script:

option testbool: bool = T;

function option_changed(ID: string, new_value: bool): bool
  {
  print fmt("Value of %s changed from %s to %s", ID, testbool, new_value);
  return new_value;
  }

event bro_init()
  {
  print "Old value", testbool;
  Option::set_change_handler("testbool", option_changed);
  Option::set("testbool", F);
  print "New value", testbool;
  }

config reader
=============

The config reader provides a way to read configuration files back into
Bro. Most importantly it automatically converts values to the correct
types. This is important because it is at least inconvenient (and
sometimes near impossible) to perform the necessary type conversions in
Bro scripts themselves. This is especially true for sets/vectors.

Configuration generally look like this:

[option name][tab/spaces][new variable value]

so, for example:

testaddr 2607:f8b0:4005:801::200e
testinterval 60
testtime 1507321987
test_set a	b	c	d	erdbeerschnitzel

The reader uses the option name to look up the type that variable has in
the Bro core and automatically converts the value to the correct type.

Example script use:

type Idx: record {
  option_name: string;
};

type Val: record {
  option_val: string;
};

global currconfig: table[string] of string = table();

event InputConfig::new_value(name: string, source: string, id: string, value: any)
  {
  print id, value;
  }

event bro_init()
  {
  Input::add_table([$reader=Input::READER_CONFIG, $source="../configfile", $name="configuration", $idx=Idx, $val=Val, $destination=currconfig, $want_record=F]);
  }

Script-level config framework
=============================

The script-level framework ties these two features together and makes
them a bit more convenient to use. Configuration files can simply be
specified by placing them into Config::config_files. The framework also
creates a config.log that shows all value changes that took place.

Usage example:

redef Config::config_files += {configfile};

export {
  option testbool : bool = F;
}

The file is now monitored for changes; when a change occurs the
respective option values are automatically updated and the value change
is written to config.log.
2017-11-29 13:46:59 -08:00
Johanna Amann
35465aaf30 Add convenient way to access version information to Bro.
With the introduction of the package manager, it will get more common
that applications are able to get information about the currently
running version of Bro. With this commit, scripts can easily compare
which version of Bro they are running.

Commonly, this probably will either look like this (both lines check if
the current Bro version is greater or equal to 2.5)

@if ( Version::num >= 20500 )
or
@if ( Version::greater_equal("2.5") )

Version::info contains detailed information about the running version of
Bro, including beta flags, etc.
2016-09-29 12:45:48 -07:00
Seth Hall
514dfc3479 Merge remote-tracking branch 'origin/master' into topic/seth/smb
# Conflicts:
#	testing/btest/Baseline/plugins.hooks/output
#	testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
#	testing/btest/Baseline/scripts.policy.misc.dump-events/smtp-events.log
2016-06-29 09:43:31 -04:00
Seth Hall
91161f790c SMB test clean up and docs 2016-06-28 10:30:41 -04:00
Seth Hall
6bc7c3f1be Merge remote-tracking branch 'origin/master' into J-Gras-topic/jgras/bit-1507
# Conflicts:
#	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2016-06-15 10:32:46 -04:00
Seth Hall
d89ee3cee0 Change the meaning of some email fields.
We now extract email addresses in the fields that one would expect
to contain addresses.  This makes further downstream processing of
these fields easier like log analysis or using these fields in the
Intel framework.  The primary downside is that any other content
in these fields is no longer available such as full name and any
group information.  I believe the simplification of the content in
these fields is worth the change.

Added "cc" to the script that feeds information from SMTP into the
Intel framework.

A new script for email handling utility functions has been created
as a side effect of these changes.
2016-06-15 10:32:06 -04:00
Seth Hall
56a24bdef6 Merge remote-tracking branch 'origin/master' into topic/seth/smb
# Conflicts:
#	scripts/site/local.bro
2016-06-14 15:35:05 -04:00
Seth Hall
134d0922d5 Move the SMB analyzer out of the default load.
This also adds a note in the local.bro script about enabling
the SMB analyzer.
2016-06-14 15:34:00 -04:00
Daniel Thayer
91496543ad Add new functions for calculating geographic distance
Added a new BIF haversine_distance that computes distance between two
geographic locations.

Added a new Bro script function haversine_distance_ip that does the same
but takes two IP addresses instead of latitude/longitude.  This function
requires that Bro be built with libgeoip.
2016-06-07 13:11:10 -05:00
Seth Hall
e2fb7591f4 Merge remote-tracking branch 'origin/master' into topic/seth/smb 2016-05-20 14:28:39 -04:00
Daniel Thayer
d91dd8d9a8 Fix Bro and unit tests when broker is not enabled
When Bro was compiled with broker disabled, then some Bro scripts
were referencing functions and types that were not defined.  Fixed
by adding @ifdefs to several scripts.  Removed one @ifdef because
it was causing several unit tests to fail.

Also fixed the @TEST-REQUIRES check in tests that rely on broker so
that such tests are skipped when broker is disabled.
2016-05-10 06:24:35 -05:00
Johanna Amann
6905984ee7 Merge remote-tracking branch 'origin/master' into topic/johanna/xmpp-starttls 2016-04-29 12:56:12 -07:00
Johanna Amann
3669b6aa9c Merge remote-tracking branch 'origin/master' into topic/johanna/imap-starttls 2016-04-26 10:52:16 -07:00
Johanna Amann
e7ec537ed5 Merge remote-tracking branch 'origin/topic/dnthayer/broker-namespace'
* origin/topic/dnthayer/broker-namespace:
  Split the broker main.bro into two scripts
  Rename the BrokerStore namespace to Broker
  Rename the BrokerComm namespace to Broker

BIT-1563 #merged
2016-04-22 16:45:09 -07:00
Seth Hall
bfc06f7e17 Merge remote-tracking branch 'origin/master' into topic/seth/smb 2016-04-13 01:57:07 -04:00
Martin van Hensbergen
849875e8be Analyzer and bro script for RFB protocol (VNC)
This analyzer parses the Remote Frame Buffer
protocol, usually referred to as the 'VNC protocol'.

It supports several dialects (3.3, 3.7, 3.8) and
also handles the Apple Remote Desktop variant.

It will log such facts as client/server versions,
authentication method used, authentication result,
height, width and name of the shared screen.

It also includes two testcases.

Todo: Apple Remote Desktop seems to have some
bytes prepended to the screen name. This is
not interepreted correctly.
2016-04-11 10:35:00 +02:00
Seth Hall
5b5589e167 Complete breakout of SMB, GSSAPI, and NTLM
- Looser coupling between these analyzers.
 - New ntlm.log (still pretty early)
 - Improved string handling for NTLM (convert UTF16 to UTF8)
 - SMB2 analyzer now supports GSSAPI.
 - Improved abstraction of DCE_RPC operations (still not finished)
 - Lots of whitespace cleanup.
2016-04-03 04:17:20 -04:00
Seth Hall
5721db4be7 Lots of cleanup and improvement to DCE/RPC analyzer.
- It works with DCE/RPC over SMB1+2 now.
   - Using named pipes in 1+2 and the transaction cmd in SMB1.
 - Base scripts based on work by Josh Liburdi.
 - New dce_rpc.log.  Feedback on how to make this log more compact
   and useful would be appreciated.
2016-04-01 09:38:52 -04:00
Daniel Thayer
9f5c820c7b Rename the BrokerComm namespace to Broker 2016-03-30 14:31:25 -05:00
Seth Hall
782e67d790 Merge remote-tracking branch 'origin/master' into topic/seth/smb 2016-03-26 21:15:41 -04:00
Johanna Amann
8650841bf5 Only load openflow/netcontrol if compiled with broker. 2016-03-24 13:39:34 -07:00
Seth Hall
802adb66ea Merge remote-tracking branch 'origin/master' into topic/seth/smb 2016-03-23 23:10:01 -04:00
Seth Hall
7251b0f240 Merge remote-tracking branch 'origin/master' into topic/seth/smb
# Conflicts:
#	scripts/base/init-default.bro
2016-01-16 21:04:43 -05:00
Johanna Amann
4a5737708c Basic IMAP StartTLS analyzer.
Parses certificates out of imap connections using StartTLS. Aborts
processing if StartTLS is not found.
2015-07-22 10:35:49 -07:00
Johanna Amann
574bcb0a51 Add simple XMPP StartTLS analyzer.
This is a very simple XMPP analyzer that basically only can parse the
protocol until the client and server start negotiating a TLS session. At
that point, the TLS analyzer is attached.

While the basic case seems to be working, I fully expect that I missed
something and that this might break in a lot of cases.
2015-07-21 12:18:14 -07:00
Johanna Amann
0e213352d7 Rename Pacf to NetControl 2015-07-08 12:34:42 -07:00
Johanna Amann
a51ee45e05 Merge remote-tracking branch 'origin/master' into topic/johanna/openflow 2015-05-12 13:08:32 -07:00
Robin Sommer
5b32791edb Merge remote-tracking branch 'origin/topic/vladg/sip'
* origin/topic/vladg/sip:
  Update NEWS.
  Update baselines.
  Spruce up SIP events.bif documentation a bit.
  Register SIP analyzer to well known port.
  Fix indenting issue in main.bro
  Add SIP btests.
  Small update for the SIP logs and DPD sig.
  SIP: Fix up DPD and the TCP analyzer a bit.
  SIP: Move to the new string BIFs
  SIP: Move to new analyzer format.
  Move the SIP analyzer to uint64 sequences, and a number of other small SIP fixes.
  Rely on content inspection and not just is_orig to determine client/server.
  Enable SIP in CMakeLists.txt
  Merge topic/seth/faf-updates.

BIT-1370 #merged
2015-04-21 15:30:25 -07:00
Robin Sommer
87eb5ef811 Merge remote-tracking branch 'origin/topic/vladg/kerberos'
* origin/topic/vladg/kerberos: (27 commits)
  Add Kerberos to NEWS.
  Add Kerberos memleak btest.
  Add Kerberos analyzer btest.
  Update baselines for Kerberos analyzer.
  Add known ports to krb/main.bro
  KRB: Clean up krb.log a bit.
  Kerberos: Remove debugging output.
  Kerberos: Fix a memleak.
  Kerberos: A couple small tweaks.
  Kerberos: Fix parsing of the cipher in tickets, and add it to the log.
  Kerberos: A couple more formatting fixes.
  Change krb Info string to success bool
  Clean up formatting.
  Documentation update, and rework events a bit.
  Add support for the SAFE message type.
  Add support for AP_REQ, AP_REP, PRIV, and CRED message types.
  Fix parsing error for KRB_Ticket_Sequence
  Continue clean-up. Some reformatting, removing hard-coded values, documentation, etc.
  Kerberos analyzer updates:   - Split up the (quite length) krb-protocol.pac into krb-protocol, krb-defs, krb-types and krb-padata   - Add some supporting types to get rid of awkward and difficult to read case true/false statements   - Clean up the conversion code in krb-analyzer.pac
  Improve Kerberos DPD and fix a few parse errors.
  ...

BIT-1369 #merged
2015-04-21 11:15:43 -07:00
Vlad Grigorescu
11eb8a6371 Merge branch 'master' of ssh://git.bro.org/bro into topic/vladg/sip
Conflicts:
	scripts/base/init-default.bro
2015-04-19 22:14:35 -04:00
Vlad Grigorescu
1ff45c9fe1 Merge remote-tracking branch 'origin/master' into topic/vladg/kerberos 2015-04-17 20:29:34 -04:00
Johanna Amann
00204ab8a6 introduce &weaken attribute, which basically only prevents
the describe function for types to descend into record fields that
are marked with it.

With this, we can actually load the pacf scripts without crashing Bro
when running tests :)
2015-04-13 16:05:55 -07:00
Johanna Amann
70f6635cb1 do not load pacf by default. There is some recursive record
definition in there Bro does not like too much...
2015-04-10 11:19:09 -07:00
Johanna Amann
94c67dc030 Merge remote-tracking branch 'origin/topic/robin/pacf' into topic/johanna/openflow 2015-04-07 17:28:38 -07:00
Vlad Grigorescu
010cd80f2f Merge remote-tracking branch 'origin/master' into topic/vladg/file-analysis-exe-analyzer 2015-04-07 14:19:15 -07:00
Seth Hall
ffdf2a46d7 Fixes tests in RDP branch.
- Re-enable MySQL.  It had accidentally been disabled.
2015-03-05 16:08:18 -05:00
Vlad Grigorescu
b90c8cb8ec Merge remote-tracking branch 'origin/master' into topic/vladg/file-analysis-exe-analyzer
Conflicts:
	src/types.bif
2015-02-19 16:59:52 -06:00
jshlbrd
2fcddc6441 Update init-default.bro
Commented out mysql
2015-02-14 13:31:23 -08:00
Josh Liburdi
46713fb5c7 Init RDP analyzer 2015-02-14 13:16:48 -08:00
Vlad Grigorescu
d852fe8b52 Merge remote-tracking branch 'origin/master' into topic/vladg/sip 2015-02-06 19:49:23 -05:00
Vlad Grigorescu
2c8a3fce49 Merge remote-tracking branch 'origin/master' into topic/vladg/kerberos
Conflicts:
	testing/btest/Baseline/core.print-bpf-filters/output2
	testing/btest/Baseline/scripts.policy.misc.dump-events/smtp-events.log
2015-01-13 14:46:18 -05:00
Vlad Grigorescu
f93f2af748 Merge tag 'v2.3' into topic/vladg/sip
Version tag

Conflicts:
	scripts/base/init-default.bro
2014-08-22 19:25:43 -04:00
Vlad Grigorescu
ca55d203cb Kerberos analyzer 2014-07-24 21:55:41 -04:00
Vlad Grigorescu
6a34de5dd8 SMB & NTLM analyzers. 2014-07-24 21:46:38 -04:00
Vlad Grigorescu
101d340b18 MySQL analyzer 2014-07-24 15:52:42 -04:00
Robin Sommer
9f0bc0fdf1 Starting to implement the proposed PACF API. 2014-07-22 03:57:05 +02:00
Vlad Grigorescu
b91b0646b8 Merge remote-tracking branch 'origin/master' into topic/vladg/file-analysis-exe-analyzer
Conflicts:
	scripts/base/init-default.bro
	src/file_analysis/analyzer/CMakeLists.txt
2014-06-21 13:15:14 -04:00
Robin Sommer
ebc8ebf5f9 Merge remote-tracking branch 'origin/master' into topic/robin/radius-merge
Conflicts:
	scripts/base/init-default.bro
2014-05-15 11:10:11 -07:00
Vlad Grigorescu
8744b66b56 Rely on content inspection and not just is_orig to determine client/server. 2014-04-22 20:31:53 -04:00