Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/analyzer-module-enable-disable-file-analyzer'

Browse source 
* origin/topic/awelzel/analyzer-module-enable-disable-file-analyzer:
  analyzer: Add file_analyzer support to enable_analyzer()/disable_analyzer()
This commit is contained in:
Robin Sommer 2022-10-05 13:27:08 +02:00
commit 6fcbb55ccd
8 changed files with 41 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
View file

@ -27,6 +27,7 @@ scripts/base/init-bare.zeek
scripts/base/frameworks/analyzer/main.zeek
scripts/base/frameworks/packet-filter/utils.zeek
build/scripts/base/bif/analyzer.bif.zeek
build/scripts/base/bif/file_analysis.bif.zeek
scripts/base/packet-protocols/root/__load__.zeek
scripts/base/packet-protocols/root/main.zeek
scripts/base/packet-protocols/ip/__load__.zeek
@ -115,7 +116,6 @@ scripts/base/init-frameworks-and-bifs.zeek
scripts/base/frameworks/analyzer/dpd.zeek
scripts/base/frameworks/files/__load__.zeek
scripts/base/frameworks/files/main.zeek
build/scripts/base/bif/file_analysis.bif.zeek
scripts/base/utils/site.zeek
scripts/base/utils/patterns.zeek
scripts/base/frameworks/files/magic/__load__.zeek

2
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -27,6 +27,7 @@ scripts/base/init-bare.zeek
scripts/base/frameworks/analyzer/main.zeek
scripts/base/frameworks/packet-filter/utils.zeek
build/scripts/base/bif/analyzer.bif.zeek
build/scripts/base/bif/file_analysis.bif.zeek
scripts/base/packet-protocols/root/__load__.zeek
scripts/base/packet-protocols/root/main.zeek
scripts/base/packet-protocols/ip/__load__.zeek
@ -115,7 +116,6 @@ scripts/base/init-frameworks-and-bifs.zeek
scripts/base/frameworks/analyzer/dpd.zeek
scripts/base/frameworks/files/__load__.zeek
scripts/base/frameworks/files/main.zeek
build/scripts/base/bif/file_analysis.bif.zeek
scripts/base/utils/site.zeek
scripts/base/utils/patterns.zeek
scripts/base/frameworks/files/magic/__load__.zeek

3
testing/btest/Baseline/plugins.hooks/output
View file

@ -716,6 +716,7 @@
0.000000 MetaHookPost CallFunction(getenv, <null>, (ZEEK_DEFAULT_LISTEN_ADDRESS)) -> <no result>
0.000000 MetaHookPost CallFunction(global_options, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(gsub, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(is_file_analyzer, <frame>, (AllAnalyzers::ANALYZER_ANALYZER_TCPSTATS)) -> <no result>
0.000000 MetaHookPost CallFunction(is_packet_analyzer, <frame>, (AllAnalyzers::ANALYZER_ANALYZER_TCPSTATS)) -> <no result>
0.000000 MetaHookPost CallFunction(lstrip, ..., ...) -> <no result>
0.000000 MetaHookPost CallFunction(network_time, <frame>, ()) -> <no result>
@ -2230,6 +2231,7 @@
0.000000 MetaHookPre CallFunction(getenv, <null>, (ZEEK_DEFAULT_LISTEN_ADDRESS))
0.000000 MetaHookPre CallFunction(global_options, <frame>, ())
0.000000 MetaHookPre CallFunction(gsub, ..., ...)
0.000000 MetaHookPre CallFunction(is_file_analyzer, <frame>, (AllAnalyzers::ANALYZER_ANALYZER_TCPSTATS))
0.000000 MetaHookPre CallFunction(is_packet_analyzer, <frame>, (AllAnalyzers::ANALYZER_ANALYZER_TCPSTATS))
0.000000 MetaHookPre CallFunction(lstrip, ..., ...)
0.000000 MetaHookPre CallFunction(network_time, <frame>, ())
@ -3743,6 +3745,7 @@
0.000000 | HookCallFunction getenv(ZEEK_DEFAULT_LISTEN_ADDRESS)
0.000000 | HookCallFunction global_options()
0.000000 | HookCallFunction gsub(...)
0.000000 | HookCallFunction is_file_analyzer(AllAnalyzers::ANALYZER_ANALYZER_TCPSTATS)
0.000000 | HookCallFunction is_packet_analyzer(AllAnalyzers::ANALYZER_ANALYZER_TCPSTATS)
0.000000 | HookCallFunction lstrip(...)
0.000000 | HookCallFunction network_time()

20
testing/btest/scripts/base/frameworks/analyzer/disabled-file-analyzers.zeek Normal file
View file

@ -0,0 +1,20 @@
# @TEST-DOC: Add the PE analyzer to Analyzer::disabled_analyzers and ensure no pe.log is created.
# First, cross-check that pe.log is indeed generated.
# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT
# @TEST-EXEC: test -f pe.log
# @TEST-EXEC: rm *log
# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT 'Analyzer::disabled_analyzers += { Files::ANALYZER_PE }'
# @TEST-EXEC: test ! -f pe.log
# @TEST-EXEC: test -f conn.log
# @TEST-EXEC: rm *log
# Finally, explicitly enable the analyzer via Analyzer::enable_analyzer() during zeek_init() and expect pe.log to be generated.
# @TEST-EXEC: zeek -b -r $TRACES/pe/pe.trace %INPUT 'Analyzer::disabled_analyzers += { Files::ANALYZER_PE }' -e 'event zeek_init() { Analyzer::enable_analyzer(Files::ANALYZER_PE); }'
# @TEST-EXEC: test -f pe.log
# @TEST-EXEC: test -f conn.log
@load base/protocols/conn
@load base/protocols/ftp
@load base/files/pe