c8103dd963
This adds a signatures/http-body-match btest to verify how the signature framework matches HTTP body in requests and responses. It currently fails because the 'http-request-body' and 'http-reply-body' clauses never match anything when there is a '$' in their regular expressions. The other pattern clauses such as the 'payload' clause do not suffer from that restriction and it is not documented as a limitation of HTTP body pattern clauses either, so it is probably a bug. The "http-body-match" btest shows that without a fix any signatures which ends with a '$' in a http-request-body or http-reply-body rule will never raise a signature_match() event, and that signatures which do not end with a '$' cannot distinguish an HTTP body prefixed by the matching pattern (ex: ABCD) from an HTTP body consisting entirely of the matching pattern (ex: AB). Test cases by source port: - 13579: - GET without body, plain res body (CD, only) - 13578: - GET without body, plain res body (CDEF, prefix) - 24680: - POST plain req body (AB, only), plain res body (CD, only) - 24681: - POST plain req body (ABCD, prefix), plain res body (CDEF, prefix) - 24682: - POST gzipped req body (AB, only), gzipped res body (CD, only) - POST plain req body (CD, only), plain res body (EF, only) - 33210: - POST multipart plain req body (AB;CD;EF, prefix) - plain res body (CD, only) - 33211: - POST multipart plain req body (ABCD;EF, prefix) - plain res body (CDEF, prefix) - 34527: - POST chunked gzipped req body (AB, only) - chunked gzipped res body (CD, only) - 34528: - POST chunked gzipped req body (ABCD, prefix) - chunked gzipped res body (CDEF, prefix) The tests with source ports 24680, 24682 and 34527 should match the signature http_request_body_AB_only and the signature http_request_body_AB_prefix, but they only match the latter. The tests with source ports 13579, 24680, 24682, 33210 and 34527 should match the signature http_response_body_CD_only and the signature http_response_body_CD_prefix, but they only match the latter. The tests with source ports 24680, 24681, 33210 and 33211 show how the http_request_body_AB_then_CD signature with two http-request-body conditions match either on one or multiple requests (documented behaviour). The test cases with other source ports show where the http_request_body_AB_only and http_response_body_CD_only signatures should not match because their bodies include more than the searched patterns. |
||
|---|---|---|
| .github/workflows | ||
| auxil | ||
| ci | ||
| cmake@f7b4fbe489 | ||
| cmake_templates | ||
| doc@9671dc111f | ||
| docker | ||
| man | ||
| scripts | ||
| src | ||
| testing | ||
| .cirrus.yml | ||
| .clang-format | ||
| .clang-tidy | ||
| .cmake-format.json | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| .pre-commit-config.yaml | ||
| .style.yapf | ||
| .typos.toml | ||
| .update-changes.cfg | ||
| CHANGES | ||
| CMakeLists.txt | ||
| configure | ||
| COPYING | ||
| COPYING-3rdparty | ||
| INSTALL | ||
| Makefile | ||
| NEWS | ||
| README | ||
| README.md | ||
| VERSION | ||
| zeek-path-dev.in | ||
The Zeek Network Security Monitor
A powerful framework for network traffic analysis and security monitoring.
Key Features — Documentation — Getting Started — Development — License
Follow us on Twitter at @zeekurity.
Key Features
-
In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at the application layer.
-
Adaptable and Flexible Zeek's domain-specific scripting language enables site-specific monitoring policies and means that it is not restricted to any particular detection approach.
-
Efficient Zeek targets high-performance networks and is used operationally at a variety of large sites.
-
Highly Stateful Zeek keeps extensive application-layer state about the network it monitors and provides a high-level archive of a network's activity.
Getting Started
The best place to find information about getting started with Zeek is our web site www.zeek.org, specifically the documentation section there. On the web site you can also find downloads for stable releases, tutorials on getting Zeek set up, and many other useful resources.
You can find release notes in NEWS, and a complete record of all changes in CHANGES.
To work with the most recent code from the development branch of Zeek, clone the master git repository:
git clone --recursive https://github.com/zeek/zeek
With all dependencies in place, build and install:
./configure && make && sudo make install
Write your first Zeek script:
# File "hello.zeek"
event zeek_init()
{
print "Hello World!";
}
And run it:
zeek hello.zeek
For learning more about the Zeek scripting language, try.zeek.org is a great resource.
Development
Zeek is developed on GitHub by its community. We welcome contributions. Working on an open source project like Zeek can be an incredibly rewarding experience and, packet by packet, makes the Internet a little safer. Today, as a result of countless contributions, Zeek is used operationally around the world by major companies and educational and scientific institutions alike for securing their cyber infrastructure.
If you're interested in getting involved, we collect feature requests and issues on GitHub here and you might find these to be a good place to get started. More information on Zeek's development can be found here, and information about its community and mailing lists (which are fairly active) can be found here.
License
Zeek comes with a BSD license, allowing for free use with virtually no restrictions. You can find it here.
Tooling
We use the following tooling to help discover issues to fix, amongst a number of others.
- Clang-Tidy
- Coverity
- PVS-Studio - static analyzer for C, C++, C#, and Java code.