Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 04:58:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Initial fixes for the problem of async actions with notice email extensions.

Browse source
This commit is contained in:
Seth Hall 2011-12-15 12:27:41 -05:00
parent f1e132cd1a
commit 2d97e25eeb
2 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/frameworks/notice/extend-email/hostnames.bro
View file

@ -2,7 +2,6 @@
module Notice;
# This probably doesn't actually work due to the async lookup_addr.
event Notice::notice(n: Notice::Info) &priority=10
{
if ( ! n?$src && ! n?$dst )
@ -11,22 +10,32 @@ event Notice::notice(n: Notice::Info) &priority=10
# This should only be done for notices that are being sent to email.
if ( ACTION_EMAIL !in n$actions )
return;
# I'm not recovering gracefully from the when statements because I want
# the notice framework to detect that something has exceeded the maximum
# allowed email delay and tell the user.
local output = "";
if ( n?$src )
{
add n$email_delay_tokens["hostnames-src"];
when ( local src_name = lookup_addr(n$src) )
{
output = string_cat("orig_h/src hostname: ", src_name, "\n");
n$email_body_sections[|n$email_body_sections|] = output;
delete n$email_delay_tokens["hostnames-src"];
}
timeout max_email_delay+5secs { }
}
if ( n?$dst )
{
add n$email_delay_tokens["hostnames-dst"];
when ( local dst_name = lookup_addr(n$dst) )
{
output = string_cat("resp_h/dst hostname: ", dst_name, "\n");
n$email_body_sections[|n$email_body_sections|] = output;
delete n$email_delay_tokens["hostnames-dst"];
}
timeout max_email_delay+5secs { }
}
}