mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
597a4d6704
- policy/ renamed to scripts/ - By default BROPATH now contains: - scripts/ - scripts/policy - scripts/site - *Nearly* all tests pass. - All of scripts/base/ is loaded by main.cc - Can be disabled by setting $BRO_NO_BASE_SCRIPTS - Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script). - The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building. - The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead. - All "detection" activity happens through scripts in scripts/policy/. - Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1) - This is so the communications framework can be loaded as part of the base without causing trouble when it's not needed. - This will be removed once a resolution to ticket #540 is reached.
77 lines
2 KiB
Text
77 lines
2 KiB
Text
##! This script logs and tracks services. In the case of this script, a service
|
|
##! is defined as an IP address and port which has responded to and fully
|
|
##! completed a TCP handshake with another host. If a protocol is detected
|
|
##! during the session, the protocol will also be logged.
|
|
|
|
module KnownServices;
|
|
|
|
redef enum Log::ID += { KNOWN_SERVICES };
|
|
|
|
export {
|
|
type Info: record {
|
|
ts: time &log;
|
|
host: addr &log;
|
|
port_num: port &log;
|
|
port_proto: transport_proto &log;
|
|
service: set[string] &log;
|
|
|
|
done: bool &default=F;
|
|
};
|
|
|
|
## The hosts whose services should be tracked and logged.
|
|
const asset_tracking = LOCAL_HOSTS &redef;
|
|
|
|
global known_services: set[addr, port] &create_expire=1day &synchronized;
|
|
|
|
global log_known_services: event(rec: Info);
|
|
}
|
|
|
|
redef record connection += {
|
|
known_services_done: bool &default=F;
|
|
known_services_watch: bool &default=F;
|
|
};
|
|
|
|
event bro_init()
|
|
{
|
|
Log::create_stream(KNOWN_SERVICES, [$columns=Info,
|
|
$ev=log_known_services]);
|
|
}
|
|
|
|
function known_services_done(c: connection)
|
|
{
|
|
local id = c$id;
|
|
if ( ! c$known_services_done &&
|
|
get_port_transport_proto(id$resp_p) == tcp &&
|
|
addr_matches_host(id$resp_h, asset_tracking) &&
|
|
[id$resp_h, id$resp_p] !in known_services &&
|
|
"ftp-data" !in c$service ) # don't include ftp data sessions
|
|
{
|
|
local i: Info;
|
|
i$ts=c$start_time;
|
|
i$host=id$resp_h;
|
|
i$port_num=id$resp_p;
|
|
i$port_proto=get_port_transport_proto(id$resp_p);
|
|
i$service=c$service;
|
|
|
|
add known_services[id$resp_h, id$resp_p];
|
|
Log::write(KNOWN_SERVICES, i);
|
|
c$known_services_done = T;
|
|
}
|
|
}
|
|
|
|
event protocol_confirmation(c: connection, atype: count, aid: count) &priority=-5
|
|
{
|
|
known_services_done(c);
|
|
}
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
c$known_services_watch=T;
|
|
}
|
|
|
|
# Handle the connection ending in case no protocol was ever detected.
|
|
event connection_state_remove(c: connection) &priority=-5
|
|
{
|
|
if ( c$known_services_watch )
|
|
known_services_done(c);
|
|
}
|