mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
Remove variable content from weird names
This changes many weird names to move non-static content from the weird name into the "addl" field to help ensure the total number of weird names is reasonably bounded. Note the net_weird and flow_weird events do not have an "addl" parameter, so information may no longer be available in those cases -- to make it available again we'd need to either (1) define new events that contain such a parameter, or (2) change net_weird/flow_weird event signature (which is a breaking change for user-code at the moment). Also, the generic handling of binpac exceptions for analyzers which to not otherwise catch and handle them has been changed from a Weird to a ProtocolViolation. Finally, a new "file_weird" event has been added for reporting weirdness found during file analysis.
This commit is contained in:
parent
956674745b
commit
995368e68c
47 changed files with 289 additions and 152 deletions
|
@ -649,3 +649,9 @@ void File::FileEvent(EventHandlerPtr h, val_list* vl)
|
|||
analyzers.DrainModifications();
|
||||
}
|
||||
}
|
||||
|
||||
bool File::PermitWeird(const char* name, uint64 threshold, uint64 rate,
|
||||
double duration)
|
||||
{
|
||||
return ::PermitWeird(weird_state, name, threshold, rate, duration);
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue