Rooba
/
cowrie
mirror of https://github.com/cowrie/cowrie.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Duplicates (#995) 

* reduce duplicates noise in logs
This commit is contained in:
Michel Oosterhof 2019-01-27 12:26:26 +04:00 committed by GitHub
parent 22910109c6
commit b4894c61fa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/cowrie/commands/curl.py
View File

@ -296,13 +296,15 @@ Options: (H) means HTTP/HTTPS only, (F) means FTP only
# If we have content already, delete temp file # If we have content already, delete temp file
if not os.path.exists(hashPath): if not os.path.exists(hashPath):
os.rename(self.safeoutfile, hashPath) os.rename(self.safeoutfile, hashPath)
duplicate = False
else: else:
os.remove(self.safeoutfile) os.remove(self.safeoutfile)
log.msg("Not storing duplicate content " + shasum) duplicate = True
self.protocol.logDispatch(eventid='cowrie.session.file_download', self.protocol.logDispatch(eventid='cowrie.session.file_download',
format='Downloaded URL (%(url)s) with SHA-256 %(shasum)s to %(outfile)s', format='Downloaded URL (%(url)s) with SHA-256 %(shasum)s to %(outfile)s',
url=self.url, url=self.url,
duplicate=duplicate,
outfile=hashPath, outfile=hashPath,
shasum=shasum, shasum=shasum,
destfile=self.safeoutfile) destfile=self.safeoutfile)

4
src/cowrie/commands/scp.py
View File

@ -121,13 +121,15 @@ class command_scp(HoneyPotCommand):
# If we have content already, delete temp file # If we have content already, delete temp file
if not os.path.exists(hash_path): if not os.path.exists(hash_path):
os.rename(self.safeoutfile, hash_path) os.rename(self.safeoutfile, hash_path)
duplicate = False
else: else:
os.remove(self.safeoutfile) os.remove(self.safeoutfile)
log.msg("Not storing duplicate content " + shasum) duplicate = True
log.msg(format='SCP Uploaded file \"%(filename)s\" to %(outfile)s', log.msg(format='SCP Uploaded file \"%(filename)s\" to %(outfile)s',
eventid='cowrie.session.file_upload', eventid='cowrie.session.file_upload',
filename=os.path.basename(fname), filename=os.path.basename(fname),
duplicate=duplicate,
url=fname, url=fname,
outfile=shasum, outfile=shasum,
shasum=shasum, shasum=shasum,

12
src/cowrie/insults/insults.py
View File

@ -128,13 +128,15 @@ class LoggingServerProtocol(insults.ServerProtocol):
shasumfile = os.path.join(self.downloadPath, shasum) shasumfile = os.path.join(self.downloadPath, shasum)
if os.path.exists(shasumfile): if os.path.exists(shasumfile):
os.remove(self.stdinlogFile) os.remove(self.stdinlogFile)
log.msg("Duplicate stdin content {}".format(shasum)) duplicate = True
else: else:
os.rename(self.stdinlogFile, shasumfile) os.rename(self.stdinlogFile, shasumfile)
duplicate = False
log.msg(eventid='cowrie.session.file_download', log.msg(eventid='cowrie.session.file_download',
format='Saved stdin contents with SHA-256 %(shasum)s to %(outfile)s', format='Saved stdin contents with SHA-256 %(shasum)s to %(outfile)s',
url='stdin', url='stdin',
duplicate=duplicate,
outfile=shasumfile, outfile=shasumfile,
shasum=shasum, shasum=shasum,
destfile='') destfile='')
@ -166,12 +168,14 @@ class LoggingServerProtocol(insults.ServerProtocol):
shasumfile = os.path.join(self.downloadPath, shasum) shasumfile = os.path.join(self.downloadPath, shasum)
if os.path.exists(shasumfile): if os.path.exists(shasumfile):
os.remove(rf) os.remove(rf)
log.msg("Duplicate redir content with hash {}".format(shasum)) duplicate = True
else: else:
os.rename(rf, shasumfile) os.rename(rf, shasumfile)
duplicate = False
log.msg(eventid='cowrie.session.file_download', log.msg(eventid='cowrie.session.file_download',
format='Saved redir contents with SHA-256 %(shasum)s to %(outfile)s', format='Saved redir contents with SHA-256 %(shasum)s to %(outfile)s',
url=url, url=url,
duplicate=duplicate,
outfile=shasumfile, outfile=shasumfile,
shasum=shasum, shasum=shasum,
destfile=url) destfile=url)
@ -186,9 +190,10 @@ class LoggingServerProtocol(insults.ServerProtocol):
shasumfile = os.path.join(self.ttylogPath, shasum) shasumfile = os.path.join(self.ttylogPath, shasum)
if os.path.exists(shasumfile): if os.path.exists(shasumfile):
log.msg("Duplicate TTY log with hash {}".format(shasum)) duplicate = True
os.remove(self.ttylogFile) os.remove(self.ttylogFile)
else: else:
duplicate = False
os.rename(self.ttylogFile, shasumfile) os.rename(self.ttylogFile, shasumfile)
umask = os.umask(0) umask = os.umask(0)
os.umask(umask) os.umask(umask)
@ -199,6 +204,7 @@ class LoggingServerProtocol(insults.ServerProtocol):
ttylog=shasumfile, ttylog=shasumfile,
size=self.ttylogSize, size=self.ttylogSize,
shasum=shasum, shasum=shasum,
duplicate=duplicate,
duration=time.time() - self.startTime) duration=time.time() - self.startTime)
insults.ServerProtocol.connectionLost(self, reason) insults.ServerProtocol.connectionLost(self, reason)