Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'"

Browse source 
This reverts commit 4e797ddbbc, reversing
changes made to 3ac28ba5a2.
This commit is contained in:
Tim Wojtulewicz 2023-05-31 09:20:33 +02:00
parent cfbb7eb8ee
commit 5a3abbe364
78 changed files with 340 additions and 1286 deletions
Download patch file Download diff file Expand all files Collapse all files

43
scripts/base/protocols/ftp/main.zeek
View file

@ -216,30 +216,27 @@ function ftp_message(c: connection)
delete s$data_channel;
}
const cluster_is_enabled = Cluster::is_enabled();
const should_publish =
Cluster::local_node_type() == Cluster::PROXY ||
Cluster::local_node_type() == Cluster::MANAGER;
event sync_add_expected_data(s: Info, chan: ExpectedDataChannel) &is_used
{
if ( should_publish )
Broker::publish(Cluster::worker_topic, sync_add_expected_data, minimize_info(s), chan);
else
{
ftp_data_expected[chan$resp_h, chan$resp_p] = s;
Analyzer::schedule_analyzer(chan$orig_h, chan$resp_h, chan$resp_p,
Analyzer::ANALYZER_FTP_DATA,
5mins);
}
@if ( Cluster::local_node_type() == Cluster::PROXY ||
Cluster::local_node_type() == Cluster::MANAGER )
Broker::publish(Cluster::worker_topic, sync_add_expected_data, minimize_info(s), chan);
@else
ftp_data_expected[chan$resp_h, chan$resp_p] = s;
Analyzer::schedule_analyzer(chan$orig_h, chan$resp_h, chan$resp_p,
Analyzer::ANALYZER_FTP_DATA,
5mins);
@endif
}
event sync_remove_expected_data(resp_h: addr, resp_p: port) &is_used
{
if ( should_publish )
Broker::publish(Cluster::worker_topic, sync_remove_expected_data, resp_h, resp_p);
else
delete ftp_data_expected[resp_h, resp_p];
@if ( Cluster::local_node_type() == Cluster::PROXY ||
Cluster::local_node_type() == Cluster::MANAGER )
Broker::publish(Cluster::worker_topic, sync_remove_expected_data, resp_h, resp_p);
@else
delete ftp_data_expected[resp_h, resp_p];
@endif
}
function add_expected_data_channel(s: Info, chan: ExpectedDataChannel)
@ -250,8 +247,9 @@ function add_expected_data_channel(s: Info, chan: ExpectedDataChannel)
Analyzer::schedule_analyzer(chan$orig_h, chan$resp_h, chan$resp_p,
Analyzer::ANALYZER_FTP_DATA,
5mins);
if ( cluster_is_enabled )
Broker::publish(ftp_relay_topic(), sync_add_expected_data, minimize_info(s), chan);
@if ( Cluster::is_enabled() )
Broker::publish(ftp_relay_topic(), sync_add_expected_data, minimize_info(s), chan);
@endif
}
event ftp_request(c: connection, command: string, arg: string) &priority=5
@ -466,8 +464,9 @@ hook finalize_ftp_data(c: connection)
if ( [c$id$resp_h, c$id$resp_p] in ftp_data_expected )
{
delete ftp_data_expected[c$id$resp_h, c$id$resp_p];
if ( cluster_is_enabled )
Broker::publish(ftp_relay_topic(), sync_remove_expected_data, c$id$resp_h, c$id$resp_p);
@if ( Cluster::is_enabled() )
Broker::publish(ftp_relay_topic(), sync_remove_expected_data, c$id$resp_h, c$id$resp_p);
@endif
}
}