Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Restore reporting messages for pcap filter issues

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-10-13 13:41:59 -05:00
parent 5e4db6d0c4
commit 81357853ed
3 changed files with 62 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/base/frameworks/packet-filter/main.zeek
View file

@ -279,23 +279,34 @@ function install(): bool
return F;
local ts = current_time();
if ( ! Pcap::precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
{
local state = Pcap::get_filter_state(DefaultPcapFilter);
local error_string : string;
if ( state == Pcap::fatal )
{
NOTICE([$note=Compile_Failure,
$msg=fmt("Compiling packet filter failed"),
$sub=tmp_filter]);
local error_string = fmt("Bad pcap filter '%s': %s", tmp_filter, Pcap::get_filter_state_string(DefaultPcapFilter));
local pkt_src_error : string = Pcap::error();
if ( pkt_src_error != "no error" )
error_string = pkt_src_error;
error_string = fmt("Bad pcap filter '%s': %s", tmp_filter,
Pcap::get_filter_state_string(DefaultPcapFilter));
if ( network_time() == 0.0 )
Reporter::fatal(error_string);
else
Reporter::warning(error_string);
}
else if ( state == Pcap::warning )
{
error_string = fmt("Warning while compiling pcap filter '%s': %s",
tmp_filter,
Pcap::get_filter_state_string(DefaultPcapFilter));
Reporter::warning(error_string);
}
}
local diff = current_time()-ts;
if ( diff > max_filter_compile_time )
NOTICE([$note=Too_Long_To_Compile_Filter,

7
scripts/base/init-bare.zeek
View file

@ -5146,6 +5146,13 @@ export {
};
type Interfaces: set[Pcap::Interface];
## The state of the compilation for a pcap filter.
type filter_state: enum {
ok, # no issues encountered
fatal, # fatal issue, something that would prevent zeek from continuing
warning # non-fatal issue that should just be logged
};
} # end export
module DCE_RPC;

35
src/iosource/pcap/pcap.bif
View file

@ -1,7 +1,6 @@
module Pcap;
const snaplen: count;
const bufsize: count;
@ -112,6 +111,40 @@ function error%(%): string
return zeek::make_intrusive<zeek::StringVal>("no error");
%}
## Returns the initialization state of a PCAP filter, or OK if the either
## there's no active packet source or the pcap filter ID does not exist.
##
## id: The PCAP filter id of a precompiled filter.
##
## Returns: A state value denoting whether any warnings or errors were
## encountered while initializing the filter.
##
## .. zeek:see:: Pcap::precompile_pcap_filter
## Pcap::install_pcap_filter
function get_filter_state%(id: PcapFilterID%): filter_state
%{
EnumTypePtr filter_state = zeek::id::find_type<EnumType>("Pcap::filter_state");
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps )
{
if ( auto filter = ps->GetBPFFilter(id->AsInt()) )
return filter_state->GetEnumVal(static_cast<zeek_int_t>(filter->GetState()));
}
return filter_state->GetEnumVal(static_cast<zeek_int_t>(iosource::FilterState::OK));
%}
## Returns a string containing any error messages that were reported by
## filter initialization.
##
## id: The PCAP filter id of a precompiled filter.
##
## Returns: Warning/error strings from the initialization process, a blank
## string if none were encountered, or '<unknown>' if either there
## is no active packet source or the filter ID doesn't exist.
##
## .. zeek:see:: Pcap::precompile_pcap_filter
## Pcap::install_pcap_filter
function get_filter_state_string%(id: PcapFilterID%): string
%{
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();