Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/timw/netbios-ssn-session-timeout-constant'

Browse source 
* origin/topic/timw/netbios-ssn-session-timeout-constant:
  Move netbios_ssn_session_timeout to a script-level constant
This commit is contained in:
Tim Wojtulewicz 2025-06-10 12:08:36 -07:00
commit 14ca808bcf
5 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
8.0.0-dev.414 | 2025-06-10 12:08:36 -0700
* Move netbios_ssn_session_timeout to a script-level constant (Tim Wojtulewicz, Corelight)
8.0.0-dev.412 | 2025-06-10 18:50:39 +0200
* btest/opt/ZAM-bif-tracking: Disable by default (Arne Welzel, Corelight)

2
VERSION
View file

@ -1 +1 @@
8.0.0-dev.412
8.0.0-dev.414

4
scripts/base/init-bare.zeek
View file

@ -579,6 +579,10 @@ const io_poll_interval_live = 10 &redef;
## while testing, but should be used sparingly.
const running_under_test: bool = F &redef;
## The amount of time before a connection created by the netbios analyzer times
## out and is removed.
const netbios_ssn_session_timeout: interval = 15 sec &redef;
module EventMetadata;
export {

12
src/analyzer/protocol/netbios/NetbiosSSN.cc
View file

@ -10,8 +10,6 @@
#include "zeek/analyzer/protocol/netbios/events.bif.h"
#include "zeek/session/Manager.h"
static constexpr double netbios_ssn_session_timeout = 15.0;
static constexpr void MAKE_INT16(uint16_t& dest, const u_char*& src) {
dest = *src;
dest <= 8;
@ -397,8 +395,9 @@ NetbiosSSN_Analyzer::NetbiosSSN_Analyzer(Connection* conn)
AddSupportAnalyzer(resp_netbios);
}
else {
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, run_state::network_time + netbios_ssn_session_timeout,
true, zeek::detail::TIMER_NB_EXPIRE);
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer,
run_state::network_time + BifConst::netbios_ssn_session_timeout, true,
zeek::detail::TIMER_NB_EXPIRE);
}
}
@ -446,12 +445,13 @@ void NetbiosSSN_Analyzer::ExpireTimer(double t) {
// The - 1.0 in the following is to allow 1 second for the
// common case of a single request followed by a single reply,
// so we don't needlessly set the timer twice in that case.
if ( run_state::terminating || run_state::network_time - Conn()->LastTime() >= netbios_ssn_session_timeout - 1.0 ) {
if ( run_state::terminating ||
run_state::network_time - Conn()->LastTime() >= BifConst::netbios_ssn_session_timeout - 1.0 ) {
Event(connection_timeout);
session_mgr->Remove(Conn());
}
else
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, t + netbios_ssn_session_timeout, true,
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, t + BifConst::netbios_ssn_session_timeout, true,
zeek::detail::TIMER_NB_EXPIRE);
}

1
src/const.bif
View file

@ -12,6 +12,7 @@ const report_gaps_for_partial: bool;
const exit_only_after_terminate: bool;
const digest_salt: string;
const max_analyzer_violations: count;
const netbios_ssn_session_timeout: interval;
const io_poll_interval_default: count;
const io_poll_interval_live: count;