Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

add Pacf plugin for the internal Bro PacketFilter (not BPF)

Browse source
This commit is contained in:
Johanna Amann 2015-05-12 15:11:41 -07:00
parent ed65fdb6ba
commit 73d22a2dbd
4 changed files with 146 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
testing/btest/scripts/base/frameworks/pacf/packetfilter.bro Normal file
View file

@ -0,0 +1,18 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
@load base/frameworks/pacf
event bro_init()
{
local pacf_packetfilter = Pacf::create_packetfilter();
Pacf::activate(pacf_packetfilter, 0);
}
event connection_established(c: connection)
{
local e = Pacf::Entity($ty=Pacf::ADDRESS, $ip=addr_to_subnet(c$id$orig_h));
local r = Pacf::Rule($ty=Pacf::DROP, $target=Pacf::MONITOR, $entity=e, $expire=10min);
Pacf::add_rule(r);
}