Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Restore reporting messages for pcap filter issues

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-10-13 13:41:59 -05:00
parent 5e4db6d0c4
commit 81357853ed
3 changed files with 62 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

31
scripts/base/frameworks/packet-filter/main.zeek
View file

@ -279,22 +279,33 @@ function install(): bool
return F; return F;
local ts = current_time(); local ts = current_time();
if ( ! Pcap::precompile_pcap_filter(DefaultPcapFilter, tmp_filter) ) if ( ! Pcap::precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
{ {
NOTICE([$note=Compile_Failure, local state = Pcap::get_filter_state(DefaultPcapFilter);
$msg=fmt("Compiling packet filter failed"), local error_string : string;
$sub=tmp_filter]); if ( state == Pcap::fatal )
{
NOTICE([$note=Compile_Failure,
$msg=fmt("Compiling packet filter failed"),
$sub=tmp_filter]);
local error_string = fmt("Bad pcap filter '%s': %s", tmp_filter, Pcap::get_filter_state_string(DefaultPcapFilter)); error_string = fmt("Bad pcap filter '%s': %s", tmp_filter,
Pcap::get_filter_state_string(DefaultPcapFilter));
local pkt_src_error : string = Pcap::error(); if ( network_time() == 0.0 )
if ( pkt_src_error != "no error" ) Reporter::fatal(error_string);
error_string = pkt_src_error; else
Reporter::warning(error_string);
}
else if ( state == Pcap::warning )
{
error_string = fmt("Warning while compiling pcap filter '%s': %s",
tmp_filter,
Pcap::get_filter_state_string(DefaultPcapFilter));
if ( network_time() == 0.0 )
Reporter::fatal(error_string);
else
Reporter::warning(error_string); Reporter::warning(error_string);
}
} }
local diff = current_time()-ts; local diff = current_time()-ts;
if ( diff > max_filter_compile_time ) if ( diff > max_filter_compile_time )

7
scripts/base/init-bare.zeek
View file

@ -5146,6 +5146,13 @@ export {
}; };
type Interfaces: set[Pcap::Interface]; type Interfaces: set[Pcap::Interface];
## The state of the compilation for a pcap filter.
type filter_state: enum {
ok, # no issues encountered
fatal, # fatal issue, something that would prevent zeek from continuing
warning # non-fatal issue that should just be logged
};
} # end export } # end export
module DCE_RPC; module DCE_RPC;

35
src/iosource/pcap/pcap.bif
View file

@ -1,7 +1,6 @@
module Pcap; module Pcap;
const snaplen: count; const snaplen: count;
const bufsize: count; const bufsize: count;
@ -112,6 +111,40 @@ function error%(%): string
return zeek::make_intrusive<zeek::StringVal>("no error"); return zeek::make_intrusive<zeek::StringVal>("no error");
%} %}
## Returns the initialization state of a PCAP filter, or OK if the either
## there's no active packet source or the pcap filter ID does not exist.
##
## id: The PCAP filter id of a precompiled filter.
##
## Returns: A state value denoting whether any warnings or errors were
## encountered while initializing the filter.
##
## .. zeek:see:: Pcap::precompile_pcap_filter
## Pcap::install_pcap_filter
function get_filter_state%(id: PcapFilterID%): filter_state
%{
EnumTypePtr filter_state = zeek::id::find_type<EnumType>("Pcap::filter_state");
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps )
{
if ( auto filter = ps->GetBPFFilter(id->AsInt()) )
return filter_state->GetEnumVal(static_cast<zeek_int_t>(filter->GetState()));
}
return filter_state->GetEnumVal(static_cast<zeek_int_t>(iosource::FilterState::OK));
%}
## Returns a string containing any error messages that were reported by
## filter initialization.
##
## id: The PCAP filter id of a precompiled filter.
##
## Returns: Warning/error strings from the initialization process, a blank
## string if none were encountered, or '<unknown>' if either there
## is no active packet source or the filter ID doesn't exist.
##
## .. zeek:see:: Pcap::precompile_pcap_filter
## Pcap::install_pcap_filter
function get_filter_state_string%(id: PcapFilterID%): string function get_filter_state_string%(id: PcapFilterID%): string
%{ %{
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc(); zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();