Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Remove icmp_conn leftovers

Browse source 
Roughly 2.5 years ago all events taking the ``icmp_conn`` parameter were
removed with 44ad614094 and the NetVar.cc
type not populated anymore.

Remove the left-overs in script land, too.
This commit is contained in:
Arne Welzel 2023-07-04 17:55:41 +02:00
parent f6f9dd2620
commit 0d6174a5d6
3 changed files with 1 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/base/frameworks/notice/main.zeek
View file

@ -81,10 +81,6 @@ export {
## reference to the actual connection will be deleted after ## reference to the actual connection will be deleted after
## applying the notice policy. ## applying the notice policy.
conn: connection &optional; conn: connection &optional;
## A shorthand way of giving the uid and id to a notice. The
## reference to the actual connection will be deleted after
## applying the notice policy.
iconn: icmp_conn &optional;
## A file record if the notice is related to a file. The ## A file record if the notice is related to a file. The
## reference to the actual fa_file record will be deleted after ## reference to the actual fa_file record will be deleted after
@ -108,7 +104,7 @@ export {
file_desc: string &log &optional; file_desc: string &log &optional;
## The transport protocol. Filled automatically when either ## The transport protocol. Filled automatically when either
## *conn*, *iconn* or *p* is specified. ## *conn* or *p* is specified.
proto: transport_proto &log &optional; proto: transport_proto &log &optional;
## The :zeek:type:`Notice::Type` of the notice. ## The :zeek:type:`Notice::Type` of the notice.
@ -668,15 +664,6 @@ function apply_policy(n: Notice::Info)
if ( n?$p ) if ( n?$p )
n$proto = get_port_transport_proto(n$p); n$proto = get_port_transport_proto(n$p);
if ( n?$iconn )
{
n$proto = icmp;
if ( ! n?$src )
n$src = n$iconn$orig_h;
if ( ! n?$dst )
n$dst = n$iconn$resp_h;
}
if ( ! n?$email_body_sections ) if ( ! n?$email_body_sections )
n$email_body_sections = vector(); n$email_body_sections = vector();
if ( ! n?$email_delay_tokens ) if ( ! n?$email_delay_tokens )

15
scripts/base/init-bare.zeek
View file

@ -231,21 +231,6 @@ type flow_id : record {
dst_p: port; ##< The destination port number. dst_p: port; ##< The destination port number.
} &log; } &log;
## Specifics about an ICMP conversation. ICMP events typically pass this in
## addition to :zeek:type:`conn_id`.
##
## .. zeek:see:: icmp_echo_reply icmp_echo_request icmp_redirect icmp_sent
## icmp_time_exceeded icmp_unreachable
type icmp_conn: record {
orig_h: addr; ##< The originator's IP address.
resp_h: addr; ##< The responder's IP address.
itype: count; ##< The ICMP type of the packet that triggered the instantiation of the record.
icode: count; ##< The ICMP code of the packet that triggered the instantiation of the record.
len: count; ##< The length of the ICMP payload of the packet that triggered the instantiation of the record.
hlim: count; ##< The encapsulating IP header's Hop Limit value.
v6: bool; ##< True if it's an ICMPv6 packet.
};
## Specifics about an ICMP conversation/packet. ## Specifics about an ICMP conversation/packet.
## ICMP events typically pass this in addition to :zeek:type:`conn_id`. ## ICMP events typically pass this in addition to :zeek:type:`conn_id`.
## ##

1
src/NetVar.cc
View file

@ -15,7 +15,6 @@ zeek::RecordType* endpoint_stats;
zeek::RecordType* connection_type; zeek::RecordType* connection_type;
zeek::RecordType* fa_file_type; zeek::RecordType* fa_file_type;
zeek::RecordType* fa_metadata_type; zeek::RecordType* fa_metadata_type;
zeek::RecordType* icmp_conn;
zeek::RecordType* icmp_context; zeek::RecordType* icmp_context;
zeek::RecordType* SYN_packet; zeek::RecordType* SYN_packet;
zeek::RecordType* pcap_packet; zeek::RecordType* pcap_packet;