def _send_event(self, task):
"""Parse the task in to a Broccoli event and send it.
:param task: A complete audit message string.
"""
args = map(parse_s_audit_arg, filter(None, task.split(' ')))
if args[0] == "channel_notty_analysis_disable_3" and len(args) == 7:
# Older SSHDs may not include channel argument, add a dummy.
args.insert(5, broccoli.count(0))
self._bc.send(*args)
def _send_event(self, task):
"""Parse the task in to a Broccoli event and send it.
:param task: A complete audit message string.
"""
args = map(parse_s_audit_arg, filter(None, task.split(' ')))
if args[0] == "channel_notty_analysis_disable_3" and len(args) == 7:
# Older SSHDs may not include channel argument, add a dummy.
args.insert(5, broccoli.count(0))
self._bc.send(*args)
import threading
import time
import traceback
import urllib
import broccoli
import pyev
# Equivalent to NERSCMSGBUF in instrumented SSHD code.
MAX_MSG_SIZE = 4096
logger = logging.getLogger(__name__)
s_audit_type_map = {
"addr": lambda str: broccoli.addr(str),
"count": lambda str: broccoli.count(str),
"double": lambda str: float(str),
"int": lambda str: int(str),
"port": lambda str: broccoli.port(str),
"uristring": lambda str: urllib.unquote_plus(str),
# Some instrumented SSHD versions may have a "string" type for (e.g.)
# session_request_direct_tcpip_3, but it's still URI encoded.
"string": lambda str: urllib.unquote_plus(str),
"subnet": lambda str: broccoli.subnet(str),
"time": lambda str: broccoli.time(str),
}
def s_audit_to_bro(type_, val):
"""Convert a string value from an instrumented SSHD to a Broccoli value.
:param type: The type indicated by the instrumented SSHD.
import threading
import time
import traceback
import urllib
import broccoli
import pyev
# Equivalent to NERSCMSGBUF in instrumented SSHD code.
MAX_MSG_SIZE = 4096
logger = logging.getLogger(__name__)
s_audit_type_map = {
"addr": lambda str: broccoli.addr(str),
"count": lambda str: broccoli.count(str),
"double": lambda str: float(str),
"int": lambda str: int(str),
"port": lambda str: broccoli.port(str),
"uristring": lambda str: urllib.unquote_plus(str),
# Some instrumented SSHD versions may have a "string" type for (e.g.)
# session_request_direct_tcpip_3, but it's still URI encoded.
"string": lambda str: urllib.unquote_plus(str),
"subnet": lambda str: broccoli.subnet(str),
"time": lambda str: broccoli.time(str),
}
def s_audit_to_bro(type_, val):
"""Convert a string value from an instrumented SSHD to a Broccoli value.
element = item.split("=")
type = element[0]
if type == "bool":
if element[1] == "T" or element[1] == "F":
val = element[1]
else:
print " parse bool:",element[1]
error_parse = error_parse + 1
continue
elif type == "count":
element[1] = databrush(type,element[1])
if element[1].isdigit():
val = broccoli.count(element[1])
else:
error_parse = error_parse + 1
print " parse count:",element[1], " ", event
continue
elif type == "time":
try:
tval = float(element[1])
except ValueError, TypeError:
error_parse = error_parse + 1
print " parse time:",element[1]
continue
else:
val = broccoli.time(element[1])
elif type == "interval":
val = broccoli.interval(element[1])
element = item.split("=")
type = element[0]
if type == "bool":
if element[1] == "T" or element[1] == "F":
val = element[1]
else:
print " parse bool:", element[1]
error_parse = error_parse + 1
continue
elif type == "count":
element[1] = databrush(type, element[1])
if element[1].isdigit():
val = broccoli.count(element[1])
else:
error_parse = error_parse + 1
print " parse count:", element[1], " ", event
continue
elif type == "time":
try:
tval = float(element[1])
except ValueError, TypeError:
error_parse = error_parse + 1
print " parse time:", element[1]
continue
else:
val = broccoli.time(element[1])
elif type == "interval":
val = broccoli.interval(element[1])
