Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

GH-1119: add base/protcols/conn/removal-hooks.zeek

Browse source 
This adds two new functions: `Conn::register_removal_hook()` and
`Conn::unregister_removal_hook()` for registering a hook function to be
called back during `connection_state_remove`.  The benefit of using hook
callback approach is better scalability: the overhead of unrelated
protocols having to dispatch no-op `connection_state_remove` handlers is
avoided.
This commit is contained in:
Jon Siwek 2020-09-10 21:19:14 -07:00
parent 49e2047da0
commit 05cf511f18
31 changed files with 659 additions and 386 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/protocols/snmp/main.zeek
View file

@ -1,5 +1,7 @@
##! Enables analysis and logging of SNMP datagrams.
@load base/protocols/conn/removal-hooks
module SNMP;
export {
@ -54,6 +56,9 @@ export {
## Event that can be handled to access the SNMP record as it is sent on
## to the logging framework.
global log_snmp: event(rec: Info);
## SNMP finalization hook. Remaining SNMP info may get logged when it's called.
global finalize_snmp: Conn::RemovalHook;
}
redef record connection += {
@ -76,6 +81,7 @@ function init_state(c: connection, h: SNMP::Header): Info
c$snmp = Info($ts=network_time(),
$uid=c$uid, $id=c$id,
$version=version_map[h$version]);
Conn::register_removal_hook(c, finalize_snmp);
}
local s = c$snmp;
@ -92,8 +98,7 @@ function init_state(c: connection, h: SNMP::Header): Info
return s;
}
event connection_state_remove(c: connection) &priority=-5
hook finalize_snmp(c: connection)
{
if ( c?$snmp )
Log::write(LOG, c$snmp);