Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Rename protocol_id field to ip_proto and similar renaming for name field

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-11-07 14:21:19 -07:00
parent d0896e81d6
commit 5e5aceb6f7
140 changed files with 214 additions and 212 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/conn/main.zeek
View file

@ -158,9 +158,11 @@ export {
## *uid* values for any encapsulating parent connections
## used over the lifetime of this inner connection.
tunnel_parents: set[string] &log &optional;
## The numeric identifier for the transport protocol for this
## connection.
protocol_id: count &log &optional;
## For IP-based connections, this contains the protocol
## identifier passed in the IP header. This is different
## from the ``proto`` field in that this value comes
## directly from the header.
ip_proto: count &log &optional;
};
## Event that can be handled to access the :zeek:type:`Conn::Info`
@ -285,7 +287,7 @@ function set_conn(c: connection, eoc: bool)
c$conn$history=c$history;
}
c$conn$protocol_id = c$id$proto;
c$conn$ip_proto = c$id$proto;
}
event content_gap(c: connection, is_orig: bool, seq: count, length: count) &priority=5

12
scripts/policy/protocols/conn/protocol-strings.zeek
View file

@ -1,12 +1,12 @@
##! This script adds a string version of the protocol_id field
##! This script adds a string version of the ip_proto field
@load base/protocols/conn
module Conn;
redef record Info += {
## A string version of the protocol_id field
protocol_name: string &log &optional;
## A string version of the ip_proto field
ip_proto_name: string &log &optional;
};
global protocol_names: table[count] of string = {
@ -159,9 +159,9 @@ global protocol_names: table[count] of string = {
};
event connection_state_remove(c: connection) {
if ( c$conn$protocol_id in protocol_names ) {
c$conn$protocol_name = protocol_names[c$conn$protocol_id];
if ( c$conn$ip_proto in protocol_names ) {
c$conn$ip_proto_name = protocol_names[c$conn$ip_proto];
} else {
c$conn$protocol_name = "unknown";
c$conn$ip_proto_name = "unknown";
}
}