Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Packet filter framework checkpoint.

Browse source
This commit is contained in:
Seth Hall 2012-04-25 23:21:53 -04:00
parent e0086005f8
commit 2ec7fbae62
2 changed files with 20 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/base/frameworks/packet-filter/main.bro
View file

@ -97,14 +97,14 @@ export {
## packet filter. ## packet filter.
global install: function(): bool; global install: function(): bool;
## A data structure to represent filter generating factories. ## A data structure to represent filter generating plugins.
type FilterFactory: record { type FilterPlugin: record {
## A function that is directly called when generating the complete filter. ## A function that is directly called when generating the complete filter.
func : function(); func : function();
}; };
## API function to register a new factory for dynamic restriction filters. ## API function to register a new pluginfor dynamic restriction filters.
global register_filter_factory: function(ff: FilterFactory); global register_filter_plugin: function(fp: FilterPlugin);
## Enables the old filtering approach of "only watch common ports for ## Enables the old filtering approach of "only watch common ports for
## analyzed protocols". ## analyzed protocols".
@ -129,7 +129,7 @@ global currently_building = F;
# Internal tracking for if the the filter being built has possibly been changed. # Internal tracking for if the the filter being built has possibly been changed.
global filter_changed = F; global filter_changed = F;
global filter_factories: set[FilterFactory] = {}; global filter_plugins: set[FilterPlugin] = {};
redef enum PcapFilterID += { redef enum PcapFilterID += {
DefaultPcapFilter, DefaultPcapFilter,
@ -182,9 +182,9 @@ event bro_init() &priority=-5
event filter_change_tracking(); event filter_change_tracking();
} }
function register_filter_factory(ff: FilterFactory) function register_filter_plugin(fp: FilterPlugin)
{ {
add filter_factories[ff]; add filter_plugins[fp];
} }
event remove_dynamic_filter(filter_id: string) event remove_dynamic_filter(filter_id: string)
@ -245,10 +245,10 @@ function build(): string
for ( filt in dynamic_restrict_filters ) for ( filt in dynamic_restrict_filters )
rfilter = combine_filters(rfilter, "and", string_cat("not (", dynamic_restrict_filters[filt], ")")); rfilter = combine_filters(rfilter, "and", string_cat("not (", dynamic_restrict_filters[filt], ")"));
# Generate all of the plugin factory based filters. # Generate all of the plugin based filters.
for ( factory in filter_factories ) for ( plugin in filter_plugins )
{ {
factory$func(); plugin$func();
} }
# Finally, join them into one filter. # Finally, join them into one filter.

17
scripts/base/frameworks/packet-filter/shunt.bro
View file

@ -46,7 +46,7 @@ export {
global shunted_conns: set[conn_id]; global shunted_conns: set[conn_id];
global shunted_host_pairs: set[conn_id]; global shunted_host_pairs: set[conn_id];
function conn_shunt_filters() function shunt_filters()
{ {
# NOTE: this could wrongly match if a connection happens with the ports reversed. # NOTE: this could wrongly match if a connection happens with the ports reversed.
local tcp_filter = "tcp and tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) == 0"; local tcp_filter = "tcp and tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) == 0";
@ -63,19 +63,18 @@ function conn_shunt_filters()
} }
local conn_shunt_filter = combine_filters(tcp_filter, "and", udp_filter); local conn_shunt_filter = combine_filters(tcp_filter, "and", udp_filter);
local hp_shunt_filter = "";
for ( id in shunted_host_pairs ) for ( id in shunted_host_pairs )
{ hp_shunt_filter = combine_filters(hp_shunt_filter, "and", fmt("host %s and host %s", id$orig_h, id$resp_h));
local hp_filter = fmt("host %s and host %s", id$orig_h, id$resp_h);
} local filter = combine_filters(conn_shunt_filter, "and", hp_shunt_filter);
PacketFilter::exclude("shunt_filters", filter);
PacketFilter::exclude("conn_shunt_filters", conn_shunt_filter);
} }
event bro_init() &priority=5 event bro_init() &priority=5
{ {
register_filter_factory([ register_filter_plugin([
$func()={ return conn_shunt_filters(); } $func()={ return shunt_filters(); }
]); ]);
} }
@ -144,7 +143,7 @@ function shunt_conn(id: conn_id): bool
NOTICE([$note=Cannot_BPF_Shunt_Conn, NOTICE([$note=Cannot_BPF_Shunt_Conn,
$msg="IPv6 connections can't be shunted with BPF due to limitations in BPF", $msg="IPv6 connections can't be shunted with BPF due to limitations in BPF",
$sub="ipv6_conn", $sub="ipv6_conn",
$id=id, $identifier=string_cat(id)]); $id=id, $identifier=cat(id)]);
return F; return F;
} }