Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Include in Jan's AF_PACKET plugin as builtin plugin

Browse source 
This has come up a few times and the motivation is mainly better "first timer"
experience with Zeek. Concretely, if one wants to run a Zeek cluster with
multiple workers and reasonable load balancing on Linux, AF_PACKET is a decent
start. Without AF_PACKET support being built into Zeek, however, a new user's
next experience is that of setting up a development environment in order
to compile an external plugin (think compiler, kernel headers, zkg, ...).
Only to get what could be termed basic functionality.

This is using the ZEEK_INCLUDE_PLUGINS infrastructure. I've used the all
upper case spelling of AF_PACKET in the help output because it seems everyone
else references/writes it like that. I think we should also write it
like that in the docs.
This commit is contained in:
Arne Welzel 2022-09-06 21:18:09 +02:00
parent a4ad4a34b2
commit 0bc7d0905e
12 changed files with 88 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

32
testing/btest/plugins/hooks-plugin/src/Plugin.cc
View file

@ -32,6 +32,21 @@ static std::set<std::string> sanitized_functions = {
"Telemetry::gauge_family_set",
};
// When a filename given to LOAD_FILE* hooks (and to the meta pre/post hooks)
// contains any of these keywords, no log message is generated.
static std::set<std::string> load_file_filter = {
"Zeek_AF_Packet",
};
static bool skip_load_file_logging_for(const std::string& s)
{
for ( const auto& needle : load_file_filter )
if ( s.find(needle) != std::string::npos )
return true;
return false;
}
zeek::plugin::Configuration Plugin::Configure()
{
EnableHook(zeek::plugin::HOOK_LOAD_FILE);
@ -93,6 +108,9 @@ static void describe_hook_args(const zeek::plugin::HookArgumentList& args, zeek:
int Plugin::HookLoadFile(const LoadType type, const std::string& file, const std::string& resolved)
{
if ( skip_load_file_logging_for(resolved) )
return -1;
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLoadFile",
file.c_str(), resolved.c_str());
return -1;
@ -102,6 +120,9 @@ std::pair<int, std::optional<std::string>> Plugin::HookLoadFileExtended(const Lo
const std::string& file,
const std::string& resolved)
{
if ( skip_load_file_logging_for(resolved) )
return std::make_pair(-1, std::nullopt);
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLoadFileExtended",
file.c_str(), resolved.c_str());
return std::make_pair(-1, std::nullopt);
@ -177,6 +198,12 @@ void Plugin::MetaHookPre(zeek::plugin::HookType hook, const zeek::plugin::HookAr
zeek::ODesc d;
d.SetShort();
describe_hook_args(args, &d);
// Special case file loading filtering.
if ( hook == zeek::plugin::HOOK_LOAD_FILE || hook == zeek::plugin::HOOK_LOAD_FILE_EXT )
if ( skip_load_file_logging_for(std::string(d.Description())) )
return;
fprintf(stderr, "%.6f %-15s %s(%s)\n", zeek::run_state::network_time, " MetaHookPre",
hook_name(hook), d.Description());
}
@ -188,6 +215,11 @@ void Plugin::MetaHookPost(zeek::plugin::HookType hook, const zeek::plugin::HookA
d1.SetShort();
describe_hook_args(args, &d1);
// Special case file loading filtering.
if ( hook == zeek::plugin::HOOK_LOAD_FILE || hook == zeek::plugin::HOOK_LOAD_FILE_EXT )
if ( skip_load_file_logging_for(std::string(d1.Description())) )
return;
zeek::ODesc d2;
d2.SetShort();
result.Describe(&d2);