mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
93894eed9b
The Logger class is now in charge of reporting all errors, warnings,
informational messages, weirds, and syslogs. All other components
route their messages through the global bro_logger singleton.
The Logger class comes with these reporting methods:
void Message(const char* fmt, ...);
void Warning(const char* fmt, ...);
void Error(const char* fmt, ...);
void FatalError(const char* fmt, ...); // Terminate Bro.
void Weird(const char* name);
[ .. some more Weird() variants ... ]
void Syslog(const char* fmt, ...);
void InternalWarning(const char* fmt, ...);
void InternalError(const char* fmt, ...); // Terminates Bro.
See Logger.h for more information on these.
Generally, the reporting now works as follows:
- All non-fatal message are reported in one of two ways:
(1) At startup (i.e., before we start processing packets),
they are logged to stderr.
(2) During processing, they turn into events:
event log_message%(msg: string, location: string%);
event log_warning%(msg: string, location: string%);
event log_error%(msg: string, location: string%);
The script level can then handle them as desired.
If we don't have an event handler, we fall back to
reporting on stderr.
- All fatal errors are logged to stderr and Bro terminates
immediately.
- Syslog(msg) directly syslogs, but doesn't do anything else.
The three main types of messages can also be generated on the
scripting layer via new Log::* bifs:
Log::error(msg: string);
Log::warning(msg: string);
Log::message(msg: string);
These pass through the bro_logger as well and thus are handled in the
same way. Their output includes location information.
More changes:
- Removed the alarm statement and the alarm_hook event.
- Adapted lots of locations to use the bro_logger, including some
of the messages that were previously either just written to
stdout, or even funneled through the alarm mechanism.
- No distinction anymore between Error() and RunTime(). There's
now only one class of errors; the line was quite blurred already
anyway.
- util.h: all the error()/warn()/message()/run_time()/pinpoint()
functions are gone. Use the bro_logger instead now.
- Script errors are formatted a bit differently due to the
changes. What I've seen so far looks ok to me, but let me know
if there's something odd.
Notes:
- The default handlers for the new log_* events are just dummy
implementations for now since we need to integrate all this into
the new scripts anyway.
- I'm not too happy with the names of the Logger class and its
instance bro_logger. We now have a LogMgr as well, which makes
this all a bit confusing. But I didn't have a good idea for
better names so I stuck with them for now.
Perhaps we should merge Logger and LogMgr?
58 lines
1.3 KiB
Text
58 lines
1.3 KiB
Text
# $Id: ssl-worm.bro 340 2004-09-09 06:38:27Z vern $
|
|
|
|
@load signatures
|
|
@load software
|
|
|
|
redef signature_files += "ssl-worm.sig";
|
|
|
|
redef capture_filters += {
|
|
["ssl-worm"] = "udp port 2002 and src net 134.96"
|
|
};
|
|
|
|
function sslworm_is_server_vulnerable(state: signature_state): bool
|
|
{
|
|
local ip = state$conn$id$resp_h;
|
|
|
|
if ( ip !in software_table )
|
|
return F;
|
|
|
|
local softset = software_table[ip];
|
|
|
|
if ( "Apache" !in softset )
|
|
return F;
|
|
|
|
if ( "OpenSSL" !in softset )
|
|
return F;
|
|
|
|
local safe_version: software_version =
|
|
[$major = +0, $minor = +9, $minor2 = +6, $addl = "e"];
|
|
|
|
if ( software_cmp_version(softset["OpenSSL"]$version, safe_version) >= 0 )
|
|
return F;
|
|
|
|
return T;
|
|
}
|
|
|
|
function sslworm_has_server_been_probed(state: signature_state): bool
|
|
{
|
|
# FIXME: Bro segfaults without the tmp variable
|
|
local result =
|
|
has_signature_matched("sslworm-probe",
|
|
state$conn$id$orig_h, state$conn$id$resp_h);
|
|
|
|
return result;
|
|
}
|
|
|
|
function sslworm_has_server_been_exploited(state: signature_state): bool
|
|
{
|
|
# FIXME: I don't know which side starts the UDP conversation
|
|
local result =
|
|
has_signature_matched("sslworm-exploit",
|
|
state$conn$id$orig_h, state$conn$id$resp_h);
|
|
|
|
if ( ! result )
|
|
result = has_signature_matched("sslworm-exploit",
|
|
state$conn$id$resp_h, state$conn$id$orig_h);
|
|
|
|
return result;
|
|
}
|