Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-1119: add base/protcols/conn/removal-hooks.zeek

Browse source 
This adds two new functions: `Conn::register_removal_hook()` and
`Conn::unregister_removal_hook()` for registering a hook function to be
called back during `connection_state_remove`.  The benefit of using hook
callback approach is better scalability: the overhead of unrelated
protocols having to dispatch no-op `connection_state_remove` handlers is
avoided.
This commit is contained in:
Jon Siwek 2020-09-10 21:19:14 -07:00
parent 49e2047da0
commit 05cf511f18
31 changed files with 659 additions and 386 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/policy/frameworks/dpd/detect-protocols.zeek
View file

@ -3,6 +3,7 @@
@load base/frameworks/notice
@load base/utils/site
@load base/utils/conn-ids
@load base/protocols/conn/removal-hooks
module ProtocolDetector;
@ -67,6 +68,9 @@ export {
# reported sub-protocols).
global servers: table[addr, port, string] of set[string]
&read_expire = 14 days;
## Non-standard protocol port detection finalization hook.
global finalize_protocol_detection: Conn::RemovalHook;
}
# Table that tracks currently active dynamic analyzers per connection.
@ -182,7 +186,7 @@ event ProtocolDetector::check_connection(c: connection)
}
}
event connection_state_remove(c: connection)
hook finalize_protocol_detection(c: connection)
{
if ( c$id !in conns )
{
@ -208,6 +212,7 @@ event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count)
else
{
conns[c$id] = set(atype);
Conn::register_removal_hook(c, finalize_protocol_detection);
local delay = min_interval(minimum_duration, check_interval);
schedule delay { ProtocolDetector::check_connection(c) };
@ -224,4 +229,5 @@ function found_protocol(c: connection, atype: Analyzer::Tag, protocol: string)
protocols[c$id] = set();
add protocols[c$id][protocol];
Conn::register_removal_hook(c, finalize_protocol_detection);
}