Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Small fix to deal with a bug in the SSL log delay mechanism.

Browse source 
- It looks like we might have some parser problem, but I just want
   to work around this problem for the moment.
This commit is contained in:
Seth Hall 2013-08-01 11:19:23 -04:00
parent 279c7b1af5
commit 2ccc963e22
3 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.1-951 | 2013-08-01 11:19:23 -0400
* Small fix to deal with a bug in the SSL log delay mechanism.
2.1-948 | 2013-07-31 20:08:28 -0700 2.1-948 | 2013-07-31 20:08:28 -0700
* Fix segfault caused by merging an empty bloom-filter with a * Fix segfault caused by merging an empty bloom-filter with a

2
VERSION
View file

@ -1 +1 @@
2.1-948 2.1-951

9
scripts/base/protocols/ssl/main.bro
View file

@ -67,11 +67,8 @@ export {
## (especially with large file transfers). ## (especially with large file transfers).
const disable_analyzer_after_detection = T &redef; const disable_analyzer_after_detection = T &redef;
## The maximum amount of time a script can delay records from being logged.
const max_log_delay = 15secs &redef;
## Delays an SSL record for a specific token: the record will not be logged ## Delays an SSL record for a specific token: the record will not be logged
## as longs the token exists or until :bro:id:`SSL::max_log_delay` elapses. ## as longs the token exists or until 15 seconds elapses.
global delay_log: function(info: Info, token: string); global delay_log: function(info: Info, token: string);
## Undelays an SSL record for a previously inserted token, allowing the ## Undelays an SSL record for a previously inserted token, allowing the
@ -90,7 +87,7 @@ redef record connection += {
redef record Info += { redef record Info += {
# Adding a string "token" to this set will cause the SSL script # Adding a string "token" to this set will cause the SSL script
# to delay logging the record until either the token has been removed or # to delay logging the record until either the token has been removed or
# the record has been delayed for :bro:id:`SSL::max_log_delay`. # the record has been delayed.
delay_tokens: set[string] &optional; delay_tokens: set[string] &optional;
}; };
@ -138,7 +135,7 @@ function log_record(info: Info)
{ {
log_record(info); log_record(info);
} }
timeout SSL::max_log_delay timeout 15secs
{ {
Reporter::info(fmt("SSL delay tokens not released in time (%s tokens remaining)", Reporter::info(fmt("SSL delay tokens not released in time (%s tokens remaining)",
|info$delay_tokens|)); |info$delay_tokens|));