zeek-dev June 2015

zeek-dev@lists.zeek.org

122 discussions

by Robin Sommer

(Cc'ing bro-dev, I suggest we continue the thread there). This sounds generally reasonable, however I think we could take the opportunity here to generalize this a bit more for generally including link-layer information into connection handling. One thing that I didn't quite get form your description is if the objective is really just to get the VLAN ID into conn.log, or whether you also want to use it for defining what constitutes a connection in the first place. The latter would aim at the situations where the same IP addresses can appear on different VLANs for independent connections. Right now, Bro can't keep them apart, but if we made the VLAN part of the connection index into the session table, it would treat them separately. Same applies to other link-level features that could sometimes be useful to be a part of a connection's ID (like MAC addresses). With that in mind, some thoughts on generalizing this (note, I not sureif you're working from 2.3 or git master. The PktSrc API has changed a bit recently, I'll take git as my starting point). - One challenge is passing the the VLAN ID through to the various packet-related methods. You're suggesting additional parameters, which would work. However, these methods are already taking a bunch of parameters, and if in the future we wanted to pass through further link-layer info, we'd have to add even more. A more flexible alternative would be switching to simply passing a Packet structure around that encapsulates all the information, including what's already there (e.g., timestmap, pcap_hdr, payload, etc.). The new PktSrc API already has such a class: PktSrc::Packet; from a quick look I think we could elevate that to be something passed around more generally, and then extend it accordingly. - For the connections, I would store the VLAN inside the ConnID struct, and then modify BuildConnIDHashKey() to take it into account. That way, the session table will make it part of its index. Same for the script-land conn_id record; that will then make script-level tables work that index by conn_id. - Extending the ConnID like this could actually be made a run-time option: I believe it shouldn't be too difficult to let users chose the fields defining a ConnID, so that they can decide if, say, they want to VLAN to be in there or not. We could predefine a set of potential features to choose from, along with some script-land API to pick the set to use, with the current 4-tuple being the default. (This could be a 2nd step for later; if the first two points above were in place, this extension should become mainly a question of finding the right configuration interface.) I haven't thought this thruogh too carefully, so it's conceivable that I'm missing something. But I think it would be really helpful for many folks to get more flexibility into the definition of what consitutes a connection, with VLANs being a good initial target to support. Robin On Tue, Apr 14, 2015 at 16:59 +0000, you wrote: > Dear Bro developers, > > I've been tasked with trying to modify the Bro source code so that > conn.log includes the VLAN IDs (including 802.1ah) that have been observed > in packets associated with that connection. I've scoped out a solution, > but I want to run it by you first before I start to go for it, in case I'm > missing something really big. > > PktSrc::Process() does processing of VLAN and 802.1ah, but it just skips > over them by advancing the data pointer. I will, in addition, store those > VLAN IDs in a new member of the modified PktSrc class. This gets passed on > through net_packet_dispatch() and NetSessions::DispatchPacket(). At this > point NetSessions::NextPacket() gets called, but since the PktSrc doesn't > get passed to it, I'd need another way to pass it the VLAN ID. I am > considering two options: > > 1. duplicate NextPacket() adding a new parameter to pass it the VLAN IDs, > and call that instead, or > 2. store the VLAN IDs in the NetSessions class, in DispatchPacket() so > it¹s available to NextPacket() and DoNextPacket() <- Is there a reason > this wouldn¹t work, e.g. issues with multi-threading/multi-processing? > > Is there one option that seems better to you? > > NetSessions::DoNextPacket() is called next and I would also need a > modification to pass it VLAN IDs, using one of the options above. In this > method we finally get access to the appropriate Connection instance, so I > would store the VLAN IDs in that instance in DoNextPacket(). > > I'd need to modify the Connection class in Conn.h to include a new member > for tracking VLAN IDs. I'd modify Connection::BuildConnVal() and > scripts/base/init-bare.bro's connection record to make the VLAN IDs > available to scripts. Lastly, I'd write a script to redef the conn Info > structure and handle one or more connection events (perhaps > connection_state_remove) to copy the VLAN IDs from the connection record > to the Info record. > > Is there anything I'm missing? Is there a better way to approach this? > -- Robin Sommer * ICSI/LBNL * robin(a)icir.org * www.icir.org/robin

5 years, 8 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ------------------------------------------ BIT-1399 [1] Bro Seth Hall Robin Sommer 2015-05-29 2.5 Normal topic/seth/deflate-missing-headers-fix [2] Open GitHub Pull Requests ========================= Issue Component User Updated Title ------- ----------- --------------- ---------- ---------------------------------------------------------------- #33 [3] bro jswaro [4] 2015-06-27 Initial commit of the TCPRS analyzer [5] #31 [6] bro yunzheng [7] 2015-06-19 Fix BIT-1314: Detect "quantum insert" type of attacks [8] #30 [9] bro jsbarber [10] 2015-06-19 Use a common Packet format and preserve layer 2 information [11] #1 [12] bro-plugins jsbarber [13] 2015-05-23 Use a common Packet format and preserve layer 2 information [14] #1 [15] btest grigorescu [16] 2015-06-22 Allow testbase overriding in the config [17] [1] BIT-1399 https://bro-tracker.atlassian.net/browse/BIT-1399 [2] deflate-missing-headers-fix https://github.com/bro/bro/tree/topic/seth/deflate-missing-headers-fix [3] Pull Request #33 https://github.com/bro/bro/pull/33 [4] jswaro https://github.com/jswaro [5] Merge Pull Request #33 with git pull --no-ff --no-commit https://github.com/jswaro/bro.git topic/jswaro/feature/initial-tcprs-release [6] Pull Request #31 https://github.com/bro/bro/pull/31 [7] yunzheng https://github.com/yunzheng [8] Merge Pull Request #31 with git pull --no-ff --no-commit https://github.com/yunzheng/bro.git topic/bit-1314 [9] Pull Request #30 https://github.com/bro/bro/pull/30 [10] jsbarber https://github.com/jsbarber [11] Merge Pull Request #30 with git pull --no-ff --no-commit https://github.com/jsbarber/bro.git topic/rework-packets [12] Pull Request #1 https://github.com/bro/bro-plugins/pull/1 [13] jsbarber https://github.com/jsbarber [14] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/jsbarber/bro-plugins.git topic/rework-packets [15] Pull Request #1 https://github.com/bro/btest/pull/1 [16] grigorescu https://github.com/grigorescu [17] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/grigorescu/btest.git topic/vladg/config_file_testbase

5 years, 11 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

5 years, 11 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

5 years, 11 months

[Bro-Dev] [JIRA] (BIT-1426) Fix an issue with the modbus protocol never being confirmed

by Robin Sommer (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1426?page=com.atlassian.jira.p… ] Robin Sommer updated BIT-1426: ------------------------------ Status: Closed (was: Merge Request) > Fix an issue with the modbus protocol never being confirmed > ----------------------------------------------------------- > > Key: BIT-1426 > URL: https://bro-tracker.atlassian.net/browse/BIT-1426 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.5 > Reporter: Seth Hall > Assignee: Robin Sommer > > The modbus analyzer now calls ConfirmProtocol after it successfully parses a PDU from both sides of a conversation which causes the conn.log to now identify "modbus" as the attached analyzer. > This is ready for merging with a test update in the topic/seth/modbus_dpd_fix branch. -- This message was sent by Atlassian JIRA (v6.5-OD-07-005#65007)

5 years, 11 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ----------------------------------------------------------- BIT-1426 [1] Bro Seth Hall Robin Sommer 2015-06-19 - Normal Fix an issue with the modbus protocol never being confirmed BIT-1399 [2] Bro Seth Hall Robin Sommer 2015-05-29 2.5 Normal topic/seth/deflate-missing-headers-fix [3] Open GitHub Pull Requests ========================= Issue Component User Updated Title -------- ----------- --------------- ---------- ---------------------------------------------------------------- #33 [4] bro jswaro [5] 2015-06-27 Initial commit of the TCPRS analyzer [6] #31 [7] bro yunzheng [8] 2015-06-19 Fix BIT-1314: Detect "quantum insert" type of attacks [9] #30 [10] bro jsbarber [11] 2015-06-19 Use a common Packet format and preserve layer 2 information [12] #1 [13] bro-plugins jsbarber [14] 2015-05-23 Use a common Packet format and preserve layer 2 information [15] #1 [16] btest grigorescu [17] 2015-06-22 Allow testbase overriding in the config [18] [1] BIT-1426 https://bro-tracker.atlassian.net/browse/BIT-1426 [2] BIT-1399 https://bro-tracker.atlassian.net/browse/BIT-1399 [3] deflate-missing-headers-fix https://github.com/bro/bro/tree/topic/seth/deflate-missing-headers-fix [4] Pull Request #33 https://github.com/bro/bro/pull/33 [5] jswaro https://github.com/jswaro [6] Merge Pull Request #33 with git pull --no-ff --no-commit https://github.com/jswaro/bro.git topic/jswaro/feature/initial-tcprs-release [7] Pull Request #31 https://github.com/bro/bro/pull/31 [8] yunzheng https://github.com/yunzheng [9] Merge Pull Request #31 with git pull --no-ff --no-commit https://github.com/yunzheng/bro.git topic/bit-1314 [10] Pull Request #30 https://github.com/bro/bro/pull/30 [11] jsbarber https://github.com/jsbarber [12] Merge Pull Request #30 with git pull --no-ff --no-commit https://github.com/jsbarber/bro.git topic/rework-packets [13] Pull Request #1 https://github.com/bro/bro-plugins/pull/1 [14] jsbarber https://github.com/jsbarber [15] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/jsbarber/bro-plugins.git topic/rework-packets [16] Pull Request #1 https://github.com/bro/btest/pull/1 [17] grigorescu https://github.com/grigorescu [18] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/grigorescu/btest.git topic/vladg/config_file_testbase

5 years, 11 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ----------------------------------------------------------- BIT-1426 [1] Bro Seth Hall Robin Sommer 2015-06-19 - Normal Fix an issue with the modbus protocol never being confirmed BIT-1399 [2] Bro Seth Hall Robin Sommer 2015-05-29 2.5 Normal topic/seth/deflate-missing-headers-fix [3] Open GitHub Pull Requests ========================= Issue Component User Updated Title -------- ----------- --------------- ---------- ---------------------------------------------------------------- #33 [4] bro jswaro [5] 2015-06-25 Initial commit of the TCPRS analyzer [6] #31 [7] bro yunzheng [8] 2015-06-19 Fix BIT-1314: Detect "quantum insert" type of attacks [9] #30 [10] bro jsbarber [11] 2015-06-19 Use a common Packet format and preserve layer 2 information [12] #1 [13] bro-plugins jsbarber [14] 2015-05-23 Use a common Packet format and preserve layer 2 information [15] #1 [16] btest grigorescu [17] 2015-06-22 Allow testbase overriding in the config [18] [1] BIT-1426 https://bro-tracker.atlassian.net/browse/BIT-1426 [2] BIT-1399 https://bro-tracker.atlassian.net/browse/BIT-1399 [3] deflate-missing-headers-fix https://github.com/bro/bro/tree/topic/seth/deflate-missing-headers-fix [4] Pull Request #33 https://github.com/bro/bro/pull/33 [5] jswaro https://github.com/jswaro [6] Merge Pull Request #33 with git pull --no-ff --no-commit https://github.com/jswaro/bro.git topic/jswaro/feature/initial-tcprs-release [7] Pull Request #31 https://github.com/bro/bro/pull/31 [8] yunzheng https://github.com/yunzheng [9] Merge Pull Request #31 with git pull --no-ff --no-commit https://github.com/yunzheng/bro.git topic/bit-1314 [10] Pull Request #30 https://github.com/bro/bro/pull/30 [11] jsbarber https://github.com/jsbarber [12] Merge Pull Request #30 with git pull --no-ff --no-commit https://github.com/jsbarber/bro.git topic/rework-packets [13] Pull Request #1 https://github.com/bro/bro-plugins/pull/1 [14] jsbarber https://github.com/jsbarber [15] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/jsbarber/bro-plugins.git topic/rework-packets [16] Pull Request #1 https://github.com/bro/btest/pull/1 [17] grigorescu https://github.com/grigorescu [18] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/grigorescu/btest.git topic/vladg/config_file_testbase

5 years, 11 months

[Bro-Dev] Making cross compile easier

by Cody

Hi, Would you guys consider making cross compile easier on your roadmap? The platform I tried to have it running was OpenWRT, which has its own problems such as the libresolv is a stub in the most popular C library choice uClibc, that is causing some troubles. What I mean is, even without these problems, any cross compile would fail because of of the use of bicfl. Apparently somebody had gone through the painful process 10 years ago: http://mailman.icsi.berkeley.edu/pipermail/bro/2005-July/001318.html This fella has created a set of patches of CMake files for 2.3.1-2: http://inspirated.com/2015/06/08/release-bro-2-3-1-2-on-openwrt Which is hosted on this github page: https://github.com/krkhan/openwrt-bro/tree/master/bro/patches The build he created would fail because old versions are not being hosted on your site, but more importantly the patches are obsolete as of 2.4. Those patches are not huge, it would be great if you guys would consider making it easier. Thanks, Cody

5 years, 11 months

[Bro-Dev] [JIRA] (BIT-1430) Cross compilation support

by Seth Hall (JIRA)

Seth Hall created BIT-1430: ------------------------------ Summary: Cross compilation support Key: BIT-1430 URL: https://bro-tracker.atlassian.net/browse/BIT-1430 Project: Bro Issue Tracker Issue Type: Problem Components: Bro Reporter: Seth Hall >From an email Cody sent to the bro-dev list:: {quote}Hi, Would you guys consider making cross compile easier on your roadmap? The platform I tried to have it running was OpenWRT, which has its own problems such as the libresolv is a stub in the most popular C library choice uClibc, that is causing some troubles. What I mean is, even without these problems, any cross compile would fail because of of the use of bicfl. Apparently somebody had gone through the painful process 10 years ago: http://mailman.icsi.berkeley.edu/pipermail/bro/2005-July/001318.html This fella has created a set of patches of CMake files for 2.3.1-2: http://inspirated.com/2015/06/08/release-bro-2-3-1-2-on-openwrt Which is hosted on this github page: https://github.com/krkhan/openwrt-bro/tree/master/bro/patches The build he created would fail because old versions are not being hosted on your site, but more importantly the patches are obsolete as of 2.4. Those patches are not huge, it would be great if you guys would consider making it easier. Thanks, Cody {quote} -- This message was sent by Atlassian JIRA (v6.5-OD-07-005#65007)

5 years, 11 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ----------------------------------------------------------- BIT-1426 [1] Bro Seth Hall Robin Sommer 2015-06-19 - Normal Fix an issue with the modbus protocol never being confirmed BIT-1399 [2] Bro Seth Hall Robin Sommer 2015-05-29 2.5 Normal topic/seth/deflate-missing-headers-fix [3] Open Fastpath Commits ====================== Commit Component Author Date Summary ----------- ----------- ------------ ---------- ---------------------------------------------- 5c060f3 [4] bro Justin Azoff 2015-06-24 Correct the name used in the header identifier Open GitHub Pull Requests ========================= Issue Component User Updated Title -------- ----------- --------------- ---------- ---------------------------------------------------------------- #33 [5] bro jswaro [6] 2015-06-25 Initial commit of the TCPRS analyzer [7] #31 [8] bro yunzheng [9] 2015-06-19 Fix BIT-1314: Detect "quantum insert" type of attacks [10] #30 [11] bro jsbarber [12] 2015-06-19 Use a common Packet format and preserve layer 2 information [13] #1 [14] bro-plugins jsbarber [15] 2015-05-23 Use a common Packet format and preserve layer 2 information [16] #1 [17] btest grigorescu [18] 2015-06-22 Allow testbase overriding in the config [19] [1] BIT-1426 https://bro-tracker.atlassian.net/browse/BIT-1426 [2] BIT-1399 https://bro-tracker.atlassian.net/browse/BIT-1399 [3] deflate-missing-headers-fix https://github.com/bro/bro/tree/topic/seth/deflate-missing-headers-fix [4] 5c060f3 https://github.com/bro/bro/commit/5c060f302e8ad0298705e1c0ab411e7fdb96f412 [5] Pull Request #33 https://github.com/bro/bro/pull/33 [6] jswaro https://github.com/jswaro [7] Merge Pull Request #33 with git pull --no-ff --no-commit https://github.com/jswaro/bro.git topic/jswaro/feature/initial-tcprs-release [8] Pull Request #31 https://github.com/bro/bro/pull/31 [9] yunzheng https://github.com/yunzheng [10] Merge Pull Request #31 with git pull --no-ff --no-commit https://github.com/yunzheng/bro.git topic/bit-1314 [11] Pull Request #30 https://github.com/bro/bro/pull/30 [12] jsbarber https://github.com/jsbarber [13] Merge Pull Request #30 with git pull --no-ff --no-commit https://github.com/jsbarber/bro.git topic/rework-packets [14] Pull Request #1 https://github.com/bro/bro-plugins/pull/1 [15] jsbarber https://github.com/jsbarber [16] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/jsbarber/bro-plugins.git topic/rework-packets [17] Pull Request #1 https://github.com/bro/btest/pull/1 [18] grigorescu https://github.com/grigorescu [19] Merge Pull Request #1 with git pull --no-ff --no-commit https://github.com/grigorescu/btest.git topic/vladg/config_file_testbase

5 years, 11 months

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zeek-dev June 2015