Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Packet filter framework checkpoint.

Browse source
This commit is contained in:
Seth Hall 2012-04-25 23:21:53 -04:00
parent e0086005f8
commit 2ec7fbae62
2 changed files with 20 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/base/frameworks/packet-filter/main.bro
View file

@ -97,14 +97,14 @@ export {
## packet filter.
global install: function(): bool;
## A data structure to represent filter generating factories.
type FilterFactory: record {
## A data structure to represent filter generating plugins.
type FilterPlugin: record {
## A function that is directly called when generating the complete filter.
func : function();
};
## API function to register a new factory for dynamic restriction filters.
global register_filter_factory: function(ff: FilterFactory);
## API function to register a new pluginfor dynamic restriction filters.
global register_filter_plugin: function(fp: FilterPlugin);
## Enables the old filtering approach of "only watch common ports for
## analyzed protocols".
@ -129,7 +129,7 @@ global currently_building = F;
# Internal tracking for if the the filter being built has possibly been changed.
global filter_changed = F;
global filter_factories: set[FilterFactory] = {};
global filter_plugins: set[FilterPlugin] = {};
redef enum PcapFilterID += {
DefaultPcapFilter,
@ -182,9 +182,9 @@ event bro_init() &priority=-5
event filter_change_tracking();
}
function register_filter_factory(ff: FilterFactory)
function register_filter_plugin(fp: FilterPlugin)
{
add filter_factories[ff];
add filter_plugins[fp];
}
event remove_dynamic_filter(filter_id: string)
@ -245,10 +245,10 @@ function build(): string
for ( filt in dynamic_restrict_filters )
rfilter = combine_filters(rfilter, "and", string_cat("not (", dynamic_restrict_filters[filt], ")"));
# Generate all of the plugin factory based filters.
for ( factory in filter_factories )
# Generate all of the plugin based filters.
for ( plugin in filter_plugins )
{
factory$func();
plugin$func();
}
# Finally, join them into one filter.

17
scripts/base/frameworks/packet-filter/shunt.bro
View file

@ -46,7 +46,7 @@ export {
global shunted_conns: set[conn_id];
global shunted_host_pairs: set[conn_id];
function conn_shunt_filters()
function shunt_filters()
{
# NOTE: this could wrongly match if a connection happens with the ports reversed.
local tcp_filter = "tcp and tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) == 0";
@ -63,19 +63,18 @@ function conn_shunt_filters()
}
local conn_shunt_filter = combine_filters(tcp_filter, "and", udp_filter);
local hp_shunt_filter = "";
for ( id in shunted_host_pairs )
{
local hp_filter = fmt("host %s and host %s", id$orig_h, id$resp_h);
hp_shunt_filter = combine_filters(hp_shunt_filter, "and", fmt("host %s and host %s", id$orig_h, id$resp_h));
}
PacketFilter::exclude("conn_shunt_filters", conn_shunt_filter);
local filter = combine_filters(conn_shunt_filter, "and", hp_shunt_filter);
PacketFilter::exclude("shunt_filters", filter);
}
event bro_init() &priority=5
{
register_filter_factory([
$func()={ return conn_shunt_filters(); }
register_filter_plugin([
$func()={ return shunt_filters(); }
]);
}
@ -144,7 +143,7 @@ function shunt_conn(id: conn_id): bool
NOTICE([$note=Cannot_BPF_Shunt_Conn,
$msg="IPv6 connections can't be shunted with BPF due to limitations in BPF",
$sub="ipv6_conn",
$id=id, $identifier=string_cat(id)]);
$id=id, $identifier=cat(id)]);
return F;
}