Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-1119: add base/protcols/conn/removal-hooks.zeek

Browse source 
This adds two new functions: `Conn::register_removal_hook()` and
`Conn::unregister_removal_hook()` for registering a hook function to be
called back during `connection_state_remove`.  The benefit of using hook
callback approach is better scalability: the overhead of unrelated
protocols having to dispatch no-op `connection_state_remove` handlers is
avoided.
This commit is contained in:
Jon Siwek 2020-09-10 21:19:14 -07:00
parent 49e2047da0
commit 05cf511f18
31 changed files with 659 additions and 386 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/base/frameworks/tunnels/main.zeek
View file

@ -5,6 +5,8 @@
##! encapsulating tunnels is also found in the *tunnel* field of
##! :zeek:type:`connection`.
@load base/protocols/conn/removal-hooks
module Tunnel;
export {
@ -80,6 +82,9 @@ export {
## encapsulated connections have been seen in the interval indicated by
## :zeek:see:`Tunnel::expiration_interval`.
global active: table[conn_id] of Info = table() &read_expire=expiration_interval &expire_func=expire;
## Tunnel finalization hook. Remaining Tunnel info may get logged when it's called.
global finalize_tunnel: Conn::RemovalHook;
}
const ayiya_ports = { 5072/udp };
@ -103,6 +108,12 @@ function register_all(ecv: EncapsulatingConnVector)
register(ecv[i]);
}
hook finalize_tunnel(c: connection)
{
if ( c$id in active )
close(active[c$id], CLOSE);
}
function register(ec: EncapsulatingConn)
{
if ( ec$cid !in active )
@ -115,6 +126,10 @@ function register(ec: EncapsulatingConn)
tunnel$action = DISCOVER;
tunnel$tunnel_type = ec$tunnel_type;
active[ec$cid] = tunnel;
if ( connection_exists(ec$cid) )
Conn::register_removal_hook(lookup_connection(ec$cid), finalize_tunnel);
Log::write(LOG, tunnel);
}
}
@ -143,9 +158,3 @@ event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5
{
register_all(e);
}
event connection_state_remove(c: connection) &priority=-5
{
if ( c$id in active )
close(active[c$id], CLOSE);
}