Hi,
i am using bro 2.5 version and i tried to compile below code and its getting
error
@load base/frameworks/notice
@load base/protocols/http
module MozillaUnusualHTTP;
export {
redef enum Notice::Type += {
Interesting_HTTP_Method_Success,
Interesting_HTTP_Method_Fail,
};
redef enum HTTP::Tags += {
HTTP_BAD_METHOD_OK,
HTTP_BAD_METHOD_FAIL,
};
global whitelist_hosts_methods: table[addr, string] of set[subnet] = table() &redef;
const suspicious_http_methods: set[string] = {
“DELETE”, “TRACE”, “CONNECT”,
“PROPPATCH”, “MKCOL”, “SEARCH”,
“COPY”, “MOVE”, “LOCK”, “UNLOCK”,
“POLL”, “REPORT”, “SUBSCRIBE”, “BMOVE”
} &redef;
const monitor_ip_spaces: set[subnet] &redef;
const monitor_ports: set[port] &redef;
const ignore_hosts_orig: set[subnet] &redef;
const ignore_hosts_resp: set[subnet] &redef;
}
event http_reply(c: connection, version: string, code: count, reason: string)
{
local cluster_client_ip: addr;
if ( ! c?$http )
return;
if ( ! c$http?$method )
return;
if ( c$id$resp_h !in monitor_ip_spaces )
return;
if ( c$id$resp_p !in monitor_ports )
return;
if ( c$id$resp_h in ignore_hosts_resp )
return;
if ( c$id$orig_h in ignore_hosts_orig )
return;
if ( ! c$http?$cluster_client_ip )
cluster_client_ip = c$id$orig_h;
else
cluster_client_ip = to_addr(c$http$cluster_client_ip);
if ( ( c$http?$cluster_client_ip ) && ( to_addr(c$http$cluster_client_ip) in ignore_hosts_orig ) )
return;
if ( c$http$method ! in suspicious_http_methods )
return;
if ( [c$id$resp_h, c$http$method] in whitelist_hosts_methods ) {
if ( c$id$orig_h in whitelist_hosts_methods[c$id$resp_h, c$http$method] )
return;
if ( cluster_client_ip in whitelist_hosts_methods[c$id$resp_h, c$http$method] )
return;
} else {
if ( c$http$status_code < 300 ) {
add c$http$tags[HTTP_BAD_METHOD_OK];
NOTICE([$note=Interesting_HTTP_Method_Success,
$msg=fmt("%s successfully used method %s on %s host %s", cluster_client_ip, c$http$method, c$id$resp_h, c$http$host),
$uid=c$uid,
$id=c$id,
$identifier=cat(c$http$host,c$http$method,cluster_client_ip)]);
} else {
add c$http$tags[HTTP_BAD_METHOD_FAIL];
NOTICE([$note=Interesting_HTTP_Method_Fail,
$msg=fmt("%s failed to used method %s on %s host %s", cluster_client_ip, c$http$method, c$id$resp_h, c$http$host),
$uid=c$uid,
$id=c$id,
$identifier=cat(c$http$host,c$http$method,cluster_client_ip)]);
}
}
error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 68: no such field in record (MozillaUnusualHTTP::c$http?$cluster_client_ip) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 71: no such field in record (MozillaUnusualHTTP::c$http$cluster_client_ip) error in string and /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 71: type clash (string and MozillaUnusualHTTP::c$http$) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 71 and string: type mismatch (MozillaUnusualHTTP::c$http$ and string) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 71: argument type mismatch in function call (to_addr(MozillaUnusualHTTP::c$http$)) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 72: no such field in record (MozillaUnusualHTTP::c$http?$cluster_client_ip) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 72: no such field in record (MozillaUnusualHTTP::c$http$cluster_client_ip) error in string and /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 72: type clash (string and MozillaUnusualHTTP::c$http$) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 72 and string: type mismatch (MozillaUnusualHTTP::c$http$ and string) error in /home/binu/bro/bro-findings/bro-gramming/unusual_http_methods.bro, line 72: argument type mismatch in function call (to_addr(MozillaUnusualHTTP::c$http$))
Regards,
sunu error