Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 18:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'pbcullen/topic/pbcullen/remove_exclude'

Browse source 
* pbcullen/topic/pbcullen/remove_exclude:
  Update core.pcap.filter-warning baseline
  Add PacketFilter::remove_exclude function

(cherry picked from commit d566961da5)
This commit is contained in:
Tim Wojtulewicz 2024-04-18 09:02:14 -07:00
parent 3e420c049d
commit 946ea4a091
3 changed files with 19 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/frameworks/packet-filter/main.zeek
View file

@ -101,6 +101,16 @@ export {
## installed or not.
global exclude_for: function(filter_id: string, filter: string, span: interval): bool;
## Remove a previously added exclude filter fragment by name. The
## traffic that was being filtered will be allowed through the filter
## after calling this function.
##
## filter_id: The name given to the filter fragment which you'd like to remove.
##
## Returns: A boolean value to indicate if a filter fragment with the given name
## actually installed.
global remove_exclude: function(filter_id: string): bool;
## Call this function to build and install a new dynamically built
## packet filter.
global install: function(): bool;
@ -194,12 +204,19 @@ function register_filter_plugin(fp: FilterPlugin)
}
event remove_dynamic_filter(filter_id: string)
{
remove_exclude(filter_id);
}
function remove_exclude(filter_id: string): bool
{
if ( filter_id in dynamic_restrict_filters )
{
delete dynamic_restrict_filters[filter_id];
install();
return T;
}
return F;
}
function exclude(filter_id: string, filter: string): bool