Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Initial rework of packet filter framework.

Browse source 
- Large rework on packet filter framework to make many things easier.
   - Removed the PacketFilter::all_packets variable because it was confusing.
   - New variable (PacketFilter::enable_auto_protocol_capture_filters) to re-enable the old filtering model of only sniffing ports for analyzed protocols.
   - In progress plugin model for adding filtering mechanisms.
   - New default single item for capture_filters = { ["default"] = PacketFilter::default_capture_filter };
   - Mechanism and helper functions to "shunt" traffic with filters.

- Created the Protocols framework to assist with reworking how base protocol scripts are registered with DPD and other things.
   - Protocols framework creates BPF filters for registered analyzers. (if using PacketFilter framework in that mode).
This commit is contained in:
Seth Hall 2012-02-16 11:14:57 -05:00
parent 600d015dab
commit 430cd9b146
18 changed files with 403 additions and 161 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/frameworks/protocols/__load__.bro Normal file
View file

@ -0,0 +1 @@
@load ./main

49
scripts/base/frameworks/protocols/main.bro Normal file
View file

@ -0,0 +1,49 @@
@load base/frameworks/packet-filter
module Protocols;
export {
const common_ports: table[string] of set[port] = {} &redef;
## Automatically creates a BPF filter for the specified protocol based
## on the data supplied for the protocol in the :bro:id:`common_ports`
## variable.
##
## protocol: A string representation for a protocol, e.g. "HTTP"
##
## Returns: BPF filter string.
global protocol_to_bpf: function(protocol: string): string;
global to_bpf: function(): string;
## Maps between human readable protocol identifiers (like "HTTP")
## and the internal Bro representation for an analyzer (like ANALYZER_HTTP).
## This is typically fully populated by the base protocol analyzer scripts.
const analyzer_map: table[string] of set[count] = {} &redef;
}
function protocol_to_bpf(protocol: string): string
{
# Return an empty string if an undefined protocol was given.
if ( protocol !in common_ports )
return "";
local output = "";
for ( one_port in common_ports[protocol] )
output = PacketFilter::combine_filters(output, "or", PacketFilter::port_to_bpf(one_port));
return output;
}
function to_bpf(): string
{
local output = "";
for ( p in common_ports )
output = PacketFilter::combine_filters(output, "or", protocol_to_bpf(p));
return output;
}