mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 13:38:19 +00:00
af1809aaa3
This is a larger internal change that moves the analyzer
infrastructure to a more flexible model where the available analyzers
don't need to be hardcoded at compile time anymore. While currently
they actually still are, this will in the future enable external
analyzer plugins. For now, it does already add the capability to
dynamically enable/disable analyzers from script-land, replacing the
old Analyzer::Available() methods.
There are three major parts going into this:
- A new plugin infrastructure in src/plugin. This is independent
of analyzers and will eventually support plugins for other parts
of Bro as well (think: readers and writers). The goal is that
plugins can be alternatively compiled in statically or loadead
dynamically at runtime from a shared library. While the latter
isn't there yet, there'll be almost no code change for a plugin
to make it dynamic later (hopefully :)
- New analyzer infrastructure in src/analyzer. I've moved a number
of analyzer-related classes here, including Analyzer and DPM;
the latter now renamed to Analyzer::Manager. More will move here
later. Currently, there's only one plugin here, which provides
*all* existing analyzers. We can modularize this further in the
future (or not).
- A new script interface in base/framework/analyzer. I think that
this will eventually replace the dpm framework, but for now
that's still there as well, though some parts have moved over.
I've also remove the dpd_config table; ports are now configured via
the analyzer framework. For exmaple, for SSH:
const ports = { 22/tcp } &redef;
event bro_init() &priority=5
{
...
Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports);
}
As you can see, the old ANALYZER_SSH constants have more into an enum
in the Analyzer namespace.
This is all hardly tested right now, and not everything works yet.
There's also a lot more cleanup to do (moving more classes around;
removing no longer used functionality; documenting script and C++
interfaces; regression tests). But it seems to generally work with a
small trace at least.
The debug stream "dpm" shows more about the loaded/enabled analyzers.
A new option -N lists loaded plugins and what they provide (including
those compiled in statically; i.e., right now it outputs all the
analyzers).
This is all not cast-in-stone yet, for some things we need to see if
they make sense this way. Feedback welcome.
127 lines
3.3 KiB
C++
127 lines
3.3 KiB
C++
// This code contributed by Nadi Sarrar.
|
|
|
|
#include "BitTorrent.h"
|
|
#include "TCP_Reassembler.h"
|
|
|
|
BitTorrent_Analyzer::BitTorrent_Analyzer(Connection* c)
|
|
: TCP_ApplicationAnalyzer("BITTORRENT", c)
|
|
{
|
|
interp = new binpac::BitTorrent::BitTorrent_Conn(this);
|
|
stop_orig = stop_resp = false;
|
|
stream_len_orig = stream_len_resp = 0;
|
|
}
|
|
|
|
BitTorrent_Analyzer::~BitTorrent_Analyzer()
|
|
{
|
|
delete interp;
|
|
}
|
|
|
|
void BitTorrent_Analyzer::Done()
|
|
{
|
|
TCP_ApplicationAnalyzer::Done();
|
|
|
|
interp->FlowEOF(true);
|
|
interp->FlowEOF(false);
|
|
}
|
|
|
|
void BitTorrent_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
|
|
{
|
|
uint64& this_stream_len = orig ? stream_len_orig : stream_len_resp;
|
|
bool& this_stop = orig ? stop_orig : stop_resp;
|
|
|
|
TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
|
|
|
|
assert(TCP());
|
|
|
|
if ( TCP()->IsPartial() )
|
|
// punt on partial.
|
|
return;
|
|
|
|
if ( this_stop )
|
|
return;
|
|
|
|
this_stream_len += len;
|
|
|
|
try
|
|
{
|
|
interp->NewData(orig, data, data + len);
|
|
}
|
|
catch ( binpac::Exception const &e )
|
|
{
|
|
const char except[] = "binpac exception: invalid handshake";
|
|
if ( ! strncmp(e.c_msg(), except, strlen(except)) )
|
|
// Does not look like bittorrent - silently
|
|
// drop the connection.
|
|
Parent()->RemoveChildAnalyzer(this);
|
|
else
|
|
{
|
|
DeliverWeird(fmt("Stopping BitTorrent analysis: protocol violation (%s)",
|
|
e.c_msg()), orig);
|
|
this_stop = true;
|
|
if ( stop_orig && stop_resp )
|
|
ProtocolViolation("BitTorrent: content gap and/or protocol violation");
|
|
}
|
|
}
|
|
}
|
|
|
|
void BitTorrent_Analyzer::Undelivered(int seq, int len, bool orig)
|
|
{
|
|
TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
|
|
|
// TODO: Code commented out for now. I think that shoving data that
|
|
// is definitely wrong into the parser seems like a really bad idea.
|
|
// The way it's currently tracking the next message offset isn't
|
|
// compatible with new 64bit int support in binpac either.
|
|
|
|
//uint64 entry_offset = orig ?
|
|
// *interp->upflow()->next_message_offset() :
|
|
// *interp->downflow()->next_message_offset();
|
|
//uint64& this_stream_len = orig ? stream_len_orig : stream_len_resp;
|
|
//bool& this_stop = orig ? stop_orig : stop_resp;
|
|
//
|
|
//this_stream_len += len;
|
|
//
|
|
//if ( entry_offset < this_stream_len )
|
|
// { // entry point is somewhere in the gap
|
|
// DeliverWeird("Stopping BitTorrent analysis: cannot recover from content gap", orig);
|
|
// this_stop = true;
|
|
// if ( stop_orig && stop_resp )
|
|
// ProtocolViolation("BitTorrent: content gap and/or protocol violation");
|
|
// }
|
|
//else
|
|
// { // fill the gap
|
|
// try
|
|
// {
|
|
// u_char gap[len];
|
|
// memset(gap, 0, len);
|
|
// interp->NewData(orig, gap, gap + len);
|
|
// }
|
|
// catch ( binpac::Exception const &e )
|
|
// {
|
|
// DeliverWeird("Stopping BitTorrent analysis: filling content gap failed", orig);
|
|
// this_stop = true;
|
|
// if ( stop_orig && stop_resp )
|
|
// ProtocolViolation("BitTorrent: content gap and/or protocol violation");
|
|
// }
|
|
// }
|
|
}
|
|
|
|
void BitTorrent_Analyzer::EndpointEOF(bool is_orig)
|
|
{
|
|
TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
|
|
interp->FlowEOF(is_orig);
|
|
}
|
|
|
|
void BitTorrent_Analyzer::DeliverWeird(const char* msg, bool orig)
|
|
{
|
|
if ( bittorrent_peer_weird )
|
|
{
|
|
val_list* vl = new val_list;
|
|
vl->append(BuildConnVal());
|
|
vl->append(new Val(orig, TYPE_BOOL));
|
|
vl->append(new StringVal(msg));
|
|
ConnectionEvent(bittorrent_peer_weird, vl);
|
|
}
|
|
else
|
|
Weird(msg);
|
|
}
|