Initial rework of packet filter framework.

- Large rework on packet filter framework to make many things easier.
   - Removed the PacketFilter::all_packets variable because it was confusing.
   - New variable (PacketFilter::enable_auto_protocol_capture_filters) to re-enable the old filtering model of only sniffing ports for analyzed protocols.
   - In progress plugin model for adding filtering mechanisms.
   - New default single item for capture_filters = { ["default"] = PacketFilter::default_capture_filter };
   - Mechanism and helper functions to "shunt" traffic with filters.

- Created the Protocols framework to assist with reworking how base protocol scripts are registered with DPD and other things.
   - Protocols framework creates BPF filters for registered analyzers. (if using PacketFilter framework in that mode).
This commit is contained in:
Seth Hall 2012-02-16 11:14:57 -05:00
parent 600d015dab
commit 430cd9b146
18 changed files with 403 additions and 161 deletions

View file

@ -6,6 +6,7 @@
##! is not attempted if the connection size analyzer isn't enabled.
@load base/frameworks/notice
@load base/frameworks/protocols
@load base/utils/site
@load base/utils/thresholds
@load base/utils/conn-ids
@ -73,11 +74,10 @@ export {
global log_ssh: event(rec: Info);
}
# Configure DPD and the packet filter
redef capture_filters += { ["ssh"] = "tcp port 22" };
redef dpd_config += { [ANALYZER_SSH] = [$ports = set(22/tcp)] };
redef likely_server_ports += { 22/tcp };
global analyzers = { ANALYZER_SSH };
redef Protocols::analyzer_map["SSH"] = analyzers;
global ports = { 22/tcp };
redef Protocols::common_ports["SSH"] = ports;
redef record connection += {
ssh: Info &optional;