Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Added comments and TODOs

Browse source
This commit is contained in:
Josh Liburdi 2015-02-15 10:18:52 -08:00
parent af1f4be529
commit a3ab9f5b09
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/rdp/main.bro
View file

@ -62,6 +62,8 @@ function set_session(c: connection)
} }
} }
## Currently rdp_done and rdp_tracker mimic the SSH analyzer for disabling analysis, but there might be a better method
## Once the DPD framework bug is fixed, we could possibly use the same method as SSL analyzer
function rdp_done(c: connection, done: bool) function rdp_done(c: connection, done: bool)
{ {
if ( done ) if ( done )
@ -91,8 +93,8 @@ event rdp_tracker(c: connection)
if ( connection_exists(id) ) if ( connection_exists(id) )
{ {
# If the RDP connection has been alive for more than 5secs, log it ## If the RDP connection has been alive for more than 5secs, log it
# This duration should be sufficient to collect the data that needs to be logged ## This duration should be sufficient to collect the data that needs to be logged
local diff = network_time() - c$rdp$ts; local diff = network_time() - c$rdp$ts;
if ( diff > 5secs ) if ( diff > 5secs )
{ {
@ -101,13 +103,13 @@ event rdp_tracker(c: connection)
} }
} }
# Schedule the event to run again if necessary ## Schedule the event to run again if necessary
schedule +5secs { rdp_tracker(c) }; schedule +5secs { rdp_tracker(c) };
} }
event connection_state_remove(c: connection) &priority=-5 event connection_state_remove(c: connection) &priority=-5
{ {
# Log the RDP connection if the connection is removed but the session has not been marked as done ## Log the RDP connection if the connection is removed but the session has not been marked as done
if ( c?$rdp && ! c$rdp$done ) if ( c?$rdp && ! c$rdp$done )
rdp_done(c,T); rdp_done(c,T);
} }