Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-01 22:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Move Conn::set_conn() from connection_state_remove to new_connection

Browse source 
c$conn is often needed for connection events, but it being established
in connection_state_removed can be a problem because event handlers have
to remember to call Con::set_conn().

This commit moves to call Conn::set_conn() in new_connection.

Addresses GH-4202

update logs
This commit is contained in:
Johanna Amann 2025-07-23 09:06:55 +01:00
parent 96f9cc73c3
commit 3e4f67e67c
26 changed files with 4188 additions and 4112 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/protocols/conn/main.zeek
View file

@ -295,14 +295,11 @@ function set_conn(c: connection, eoc: bool)
event content_gap(c: connection, is_orig: bool, seq: count, length: count) &priority=5
{
set_conn(c, F);
c$conn$missed_bytes = c$conn$missed_bytes + length;
}
event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5
{
set_conn(c, F);
if ( |e| > 0 )
{
if ( ! c$conn?$tunnel_parents )
@ -312,6 +309,11 @@ event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5
c$tunnel = e;
}
event new_connection(c: connection) &priority=100
{
set_conn(c, F);
}
event connection_state_remove(c: connection) &priority=5
{
set_conn(c, T);

3
scripts/policy/protocols/conn/community-id-logging.zeek
View file

@ -17,10 +17,7 @@ export {
};
}
module Conn;
event new_connection(c: connection) &priority=5
{
Conn::set_conn(c, F); # likely first to access :-/
c$conn$community_id = community_id_v1(c$id, CommunityID::seed, CommunityID::do_base64);
}

2
scripts/policy/protocols/conn/failed-service-logging.zeek
View file

@ -30,8 +30,6 @@ event analyzer_failed(ts: time, atype: AllAnalyzers::Tag, info: AnalyzerViolatio
if ( analyzer_name !in c$service || analyzer_name in c$failed_analyzers )
return;
set_conn(c, F);
local aname = to_lower(Analyzer::name(atype));
# No duplicate logging
if ( c$conn?$failed_service && aname in c$conn$failed_service )

2
scripts/policy/protocols/conn/ip-proto-name-logging.zeek
View file

@ -12,8 +12,6 @@ redef record Info += {
};
event new_connection(c: connection) &priority=5 {
# In case we're the first access
Conn::set_conn(c, F);
if ( c$conn?$ip_proto && c$conn$ip_proto in IP::protocol_names )
c$conn$ip_proto_name = IP::protocol_names[c$conn$ip_proto];
}

3
scripts/policy/protocols/conn/pppoe-session-id-logging.zeek
View file

@ -19,9 +19,6 @@ event new_connection(c: connection)
if ( session_id == 0xFFFFFFFF )
return;
# FIXME: remove when GH-4688 is merged
set_conn(c, F);
c$conn$pppoe_session_id = session_id;
}