Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Restore reporting messages for pcap filter issues

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-10-13 13:41:59 -05:00
parent 5e4db6d0c4
commit 81357853ed
3 changed files with 62 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

31
scripts/base/frameworks/packet-filter/main.zeek
View file

@ -279,22 +279,33 @@ function install(): bool
return F;
local ts = current_time();
if ( ! Pcap::precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
{
NOTICE([$note=Compile_Failure,
$msg=fmt("Compiling packet filter failed"),
$sub=tmp_filter]);
local state = Pcap::get_filter_state(DefaultPcapFilter);
local error_string : string;
if ( state == Pcap::fatal )
{
NOTICE([$note=Compile_Failure,
$msg=fmt("Compiling packet filter failed"),
$sub=tmp_filter]);
local error_string = fmt("Bad pcap filter '%s': %s", tmp_filter, Pcap::get_filter_state_string(DefaultPcapFilter));
error_string = fmt("Bad pcap filter '%s': %s", tmp_filter,
Pcap::get_filter_state_string(DefaultPcapFilter));
local pkt_src_error : string = Pcap::error();
if ( pkt_src_error != "no error" )
error_string = pkt_src_error;
if ( network_time() == 0.0 )
Reporter::fatal(error_string);
else
Reporter::warning(error_string);
}
else if ( state == Pcap::warning )
{
error_string = fmt("Warning while compiling pcap filter '%s': %s",
tmp_filter,
Pcap::get_filter_state_string(DefaultPcapFilter));
if ( network_time() == 0.0 )
Reporter::fatal(error_string);
else
Reporter::warning(error_string);
}
}
local diff = current_time()-ts;
if ( diff > max_filter_compile_time )

7
scripts/base/init-bare.zeek
View file

@ -5146,6 +5146,13 @@ export {
};
type Interfaces: set[Pcap::Interface];
## The state of the compilation for a pcap filter.
type filter_state: enum {
ok, # no issues encountered
fatal, # fatal issue, something that would prevent zeek from continuing
warning # non-fatal issue that should just be logged
};
} # end export
module DCE_RPC;