Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add PacketFilter::remove_exclude function

Browse source 
This adds a public function to the PacketFilter framework that
allows the caller to remove an exclude filter by filter id.
This commit is contained in:
Peter Cullen 2024-04-17 21:25:35 +00:00
parent 1563814c4a
commit 81856cc391
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/frameworks/packet-filter/main.zeek
View file

@ -101,6 +101,16 @@ export {
## installed or not.
global exclude_for: function(filter_id: string, filter: string, span: interval): bool;
## Remove a previously added exclude filter fragment by name. The
## traffic that was being filtered will be allowed through the filter
## after calling this function.
##
## filter_id: The name given to the filter fragment which you'd like to remove.
##
## Returns: A boolean value to indicate if a filter fragment with the given name
## actually installed.
global remove_exclude: function(filter_id: string): bool;
## Call this function to build and install a new dynamically built
## packet filter.
global install: function(): bool;
@ -194,12 +204,19 @@ function register_filter_plugin(fp: FilterPlugin)
}
event remove_dynamic_filter(filter_id: string)
{
remove_exclude(filter_id);
}
function remove_exclude(filter_id: string): bool
{
if ( filter_id in dynamic_restrict_filters )
{
delete dynamic_restrict_filters[filter_id];
install();
return T;
}
return F;
}
function exclude(filter_id: string, filter: string): bool