mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Resolve conflicts for cherry-pick to 7.0
This commit is contained in:
Arne Welzel
parent
dd447c3f15
commit
a5c4ae4291
32 changed files with 92 additions and 467 deletions
|
|
@ -388,264 +388,6 @@ type endpoint_stats: record {
|
||||||
endian_type: count;
|
endian_type: count;
|
||||||
};
|
};
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
=======
|
|
||||||
## Record containing information about a tag.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: get_tags_by_category
|
|
||||||
type tag_component: record {
|
|
||||||
name: string;
|
|
||||||
canonical_name: string;
|
|
||||||
tag: string;
|
|
||||||
enabled: bool;
|
|
||||||
};
|
|
||||||
|
|
||||||
type tag_component_vec : vector of tag_component;
|
|
||||||
|
|
||||||
## Arguments given to Zeek from the command line. In order to use this, Zeek
|
|
||||||
## must use a ``--`` command line argument immediately followed by a script
|
|
||||||
## file and additional arguments after that. For example::
|
|
||||||
##
|
|
||||||
## zeek --bare-mode -- myscript.zeek -a -b -c
|
|
||||||
##
|
|
||||||
## To use Zeek as an executable interpreter, include a line at the top of a script
|
|
||||||
## like the following and make the script executable::
|
|
||||||
##
|
|
||||||
## #!/usr/local/zeek/bin/zeek --
|
|
||||||
const zeek_script_args: vector of string = vector();
|
|
||||||
|
|
||||||
## BPF filter the user has set via the -f command line options. Empty if none.
|
|
||||||
const cmd_line_bpf_filter = "" &redef;
|
|
||||||
|
|
||||||
## Base time of log rotations in 24-hour time format (``%H:%M``), e.g. "12:00".
|
|
||||||
const log_rotate_base_time = "0:00" &redef;
|
|
||||||
|
|
||||||
## Whether to attempt to automatically detect SYN/FIN/RST-filtered trace
|
|
||||||
## and not report missing segments for such connections.
|
|
||||||
## If this is enabled, then missing data at the end of connections may not
|
|
||||||
## be reported via :zeek:see:`content_gap`.
|
|
||||||
const detect_filtered_trace = F &redef;
|
|
||||||
|
|
||||||
## Whether we want :zeek:see:`content_gap` for partial
|
|
||||||
## connections. A connection is partial if it is missing a full handshake. Note
|
|
||||||
## that gap reports for partial connections might not be reliable.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: content_gap partial_connection
|
|
||||||
const report_gaps_for_partial = F &redef;
|
|
||||||
|
|
||||||
## Flag to prevent Zeek from exiting automatically when input is exhausted.
|
|
||||||
## Normally Zeek terminates when all packet sources have gone dry
|
|
||||||
## and communication isn't enabled. If this flag is set, Zeek's main loop will
|
|
||||||
## instead keep idling until :zeek:see:`terminate` is explicitly called.
|
|
||||||
##
|
|
||||||
## This is mainly for testing purposes when termination behaviour needs to be
|
|
||||||
## controlled for reproducing results.
|
|
||||||
const exit_only_after_terminate = F &redef;
|
|
||||||
|
|
||||||
## Default mode for Zeek's user-space dynamic packet filter. If true, packets
|
|
||||||
## that aren't explicitly allowed through, are dropped from any further
|
|
||||||
## processing.
|
|
||||||
##
|
|
||||||
## .. note:: This is not the BPF packet filter but an additional dynamic filter
|
|
||||||
## that Zeek optionally applies just before normal processing starts.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: install_dst_addr_filter install_dst_net_filter
|
|
||||||
## install_src_addr_filter install_src_net_filter uninstall_dst_addr_filter
|
|
||||||
## uninstall_dst_net_filter uninstall_src_addr_filter uninstall_src_net_filter
|
|
||||||
const packet_filter_default = F &redef;
|
|
||||||
|
|
||||||
## Maximum size of regular expression groups for signature matching.
|
|
||||||
const sig_max_group_size = 50 &redef;
|
|
||||||
|
|
||||||
## Description transmitted to remote communication peers for identification.
|
|
||||||
const peer_description = "zeek" &redef;
|
|
||||||
|
|
||||||
## Reassemble the beginning of all TCP connections before doing
|
|
||||||
## signature matching. Enabling this provides more accurate matching at the
|
|
||||||
## expense of CPU cycles.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: dpd_buffer_size
|
|
||||||
## dpd_match_only_beginning dpd_ignore_ports
|
|
||||||
##
|
|
||||||
## .. note:: Despite the name, this option affects *all* signature matching, not
|
|
||||||
## only signatures used for dynamic protocol detection.
|
|
||||||
const dpd_reassemble_first_packets = T &redef;
|
|
||||||
|
|
||||||
## Size of per-connection buffer used for dynamic protocol detection. For each
|
|
||||||
## connection, Zeek buffers this initial amount of payload in memory so that
|
|
||||||
## complete protocol analysis can start even after the initial packets have
|
|
||||||
## already passed through (i.e., when a DPD signature matches only later).
|
|
||||||
## However, once the buffer is full, data is deleted and lost to analyzers that
|
|
||||||
## are activated afterwards. Then only analyzers that can deal with partial
|
|
||||||
## connections will be able to analyze the session.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: dpd_reassemble_first_packets dpd_match_only_beginning
|
|
||||||
## dpd_ignore_ports dpd_max_packets
|
|
||||||
const dpd_buffer_size = 1024 &redef;
|
|
||||||
|
|
||||||
## Maximum number of per-connection packets that will be buffered for dynamic
|
|
||||||
## protocol detection. For each connection, Zeek buffers up to this amount
|
|
||||||
## of packets in memory so that complete protocol analysis can start even after
|
|
||||||
## the initial packets have already passed through (i.e., when a DPD signature
|
|
||||||
## matches only later). However, once the buffer is full, data is deleted and lost
|
|
||||||
## to analyzers that are activated afterwards. Then only analyzers that can deal
|
|
||||||
## with partial connections will be able to analyze the session.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: dpd_reassemble_first_packets dpd_match_only_beginning
|
|
||||||
## dpd_ignore_ports dpd_buffer_size
|
|
||||||
const dpd_max_packets = 100 &redef;
|
|
||||||
|
|
||||||
## If true, stops signature matching if :zeek:see:`dpd_buffer_size` has been
|
|
||||||
## reached.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: dpd_reassemble_first_packets dpd_buffer_size
|
|
||||||
## dpd_ignore_ports
|
|
||||||
##
|
|
||||||
## .. note:: Despite the name, this option affects *all* signature matching, not
|
|
||||||
## only signatures used for dynamic protocol detection.
|
|
||||||
const dpd_match_only_beginning = T &redef;
|
|
||||||
|
|
||||||
## If true, stops signature matching after a late match. A late match may occur
|
|
||||||
## in case the DPD buffer is exhausted but a protocol signature matched. To
|
|
||||||
## allow late matching, :zeek:see:`dpd_match_only_beginning` must be disabled.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: dpd_reassemble_first_packets dpd_buffer_size
|
|
||||||
## dpd_match_only_beginning
|
|
||||||
##
|
|
||||||
## .. note:: Despite the name, this option stops *all* signature matching, not
|
|
||||||
## only signatures used for dynamic protocol detection but is triggered by
|
|
||||||
## DPD signatures only.
|
|
||||||
const dpd_late_match_stop = F &redef;
|
|
||||||
|
|
||||||
## If true, don't consider any ports for deciding which protocol analyzer to
|
|
||||||
## use.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: dpd_reassemble_first_packets dpd_buffer_size
|
|
||||||
## dpd_match_only_beginning
|
|
||||||
const dpd_ignore_ports = F &redef;
|
|
||||||
|
|
||||||
## Ports which the core considers being likely used by servers. For ports in
|
|
||||||
## this set, it may heuristically decide to flip the direction of the
|
|
||||||
## connection if it misses the initial handshake.
|
|
||||||
const likely_server_ports: set[port] &redef;
|
|
||||||
|
|
||||||
## Holds the filename of the trace file given with ``-w`` (empty if none).
|
|
||||||
##
|
|
||||||
## .. zeek:see:: record_all_packets
|
|
||||||
const trace_output_file = "";
|
|
||||||
|
|
||||||
## If a trace file is given with ``-w``, dump *all* packets seen by Zeek into it.
|
|
||||||
## By default, Zeek applies (very few) heuristics to reduce the volume. A side
|
|
||||||
## effect of setting this to true is that we can write the packets out before we
|
|
||||||
## actually process them, which can be helpful for debugging in case the
|
|
||||||
## analysis triggers a crash.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: trace_output_file
|
|
||||||
const record_all_packets = F &redef;
|
|
||||||
|
|
||||||
## Ignore certain TCP retransmissions for :zeek:see:`conn_stats`. Some
|
|
||||||
## connections (e.g., SSH) retransmit the acknowledged last byte to keep the
|
|
||||||
## connection alive. If *ignore_keep_alive_rexmit* is set to true, such
|
|
||||||
## retransmissions will be excluded in the rexmit counter in
|
|
||||||
## :zeek:see:`conn_stats`.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: conn_stats
|
|
||||||
const ignore_keep_alive_rexmit = F &redef;
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Seed for hashes computed internally for probabilistic data structures. Using
|
|
||||||
## the same value here will make the hashes compatible between independent Zeek
|
|
||||||
## instances. If left unset, Zeek will use a temporary local seed.
|
|
||||||
const global_hash_seed: string = "" &redef;
|
|
||||||
|
|
||||||
## Number of bits in UIDs that are generated to identify connections and
|
|
||||||
## files. The larger the value, the more confidence in UID uniqueness.
|
|
||||||
## The maximum is currently 128 bits.
|
|
||||||
const bits_per_uid: count = 96 &redef;
|
|
||||||
|
|
||||||
## This salt value is used for several message digests in Zeek. We
|
|
||||||
## use a salt to help mitigate the possibility of an attacker
|
|
||||||
## manipulating source data to, e.g., mount complexity attacks or
|
|
||||||
## cause ID collisions.
|
|
||||||
## This salt is, for example, used by :zeek:see:`get_file_handle`
|
|
||||||
## to generate installation-unique file IDs (the *id* field of :zeek:see:`fa_file`).
|
|
||||||
const digest_salt = "Please change this value." &redef;
|
|
||||||
|
|
||||||
## Maximum string length allowed for calls to the :zeek:see:`find_all` and
|
|
||||||
## :zeek:see:`find_all_ordered` BIFs.
|
|
||||||
const max_find_all_string_length: int = 10000 &redef;
|
|
||||||
|
|
||||||
## How many rounds to go without checking IO sources with file descriptors
|
|
||||||
## for readiness by default. This is used when reading from traces.
|
|
||||||
##
|
|
||||||
## Very roughly, when reading from a pcap, setting this to 100 results in
|
|
||||||
## 100 packets being processed without checking FD based IO sources.
|
|
||||||
##
|
|
||||||
## .. note:: This should not be changed outside of development or when
|
|
||||||
## debugging problems with the main-loop, or developing features with
|
|
||||||
## tight main-loop interaction.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: io_poll_interval_live
|
|
||||||
const io_poll_interval_default = 100 &redef;
|
|
||||||
|
|
||||||
## How often to check IO sources with file descriptors for readiness when
|
|
||||||
## monitoring with a live packet source.
|
|
||||||
##
|
|
||||||
## The poll interval gets defaulted to 100 which is good for cases like reading
|
|
||||||
## from pcap files and when there isn't a packet source, but is a little too
|
|
||||||
## infrequent for live sources (especially fast live sources). Set it down a
|
|
||||||
## little bit for those sources.
|
|
||||||
##
|
|
||||||
## .. note:: This should not be changed outside of development or when
|
|
||||||
## debugging problems with the main-loop, or developing features with
|
|
||||||
## tight main-loop interaction.
|
|
||||||
##
|
|
||||||
## .. zeek:see:: io_poll_interval_default
|
|
||||||
const io_poll_interval_live = 10 &redef;
|
|
||||||
|
|
||||||
## Whether Zeek is being run under test. This can be used to alter functionality
|
|
||||||
## while testing, but should be used sparingly.
|
|
||||||
const running_under_test: bool = F &redef;
|
|
||||||
|
|
||||||
## The amount of time before a connection created by the netbios analyzer times
|
|
||||||
## out and is removed.
|
|
||||||
const netbios_ssn_session_timeout: interval = 15 sec &redef;
|
|
||||||
|
|
||||||
module EventMetadata;
|
|
||||||
|
|
||||||
export {
|
|
||||||
## Enum type for metadata identifiers.
|
|
||||||
type ID: enum {
|
|
||||||
NETWORK_TIMESTAMP = 1,
|
|
||||||
};
|
|
||||||
|
|
||||||
## A event metadata entry.
|
|
||||||
type Entry: record {
|
|
||||||
id: EventMetadata::ID; ##< The registered :zeek:see:`EventMetadata::ID` value.
|
|
||||||
val: any; ##< The value. Its type matches what was passed to :zeek:see:`EventMetadata::register`.
|
|
||||||
};
|
|
||||||
|
|
||||||
## Add network timestamp metadata to all events.
|
|
||||||
##
|
|
||||||
## Adding network timestamp metadata affects local and
|
|
||||||
## remote events. Events scheduled have a network timestamp
|
|
||||||
## of when the scheduled timer was supposed to expire, which
|
|
||||||
## might be a value before the network_time() when the event
|
|
||||||
## was actually dispatched.
|
|
||||||
const add_network_timestamp: bool = F &redef;
|
|
||||||
|
|
||||||
## By default, remote events without network timestamp metadata
|
|
||||||
## will yield a negative zeek:see:`current_event_time` during
|
|
||||||
## processing. To have the receiving Zeek node set the event's
|
|
||||||
## network timestamp metadata with its current local network time,
|
|
||||||
## set this option to true.
|
|
||||||
##
|
|
||||||
## This setting is only in effect if :zeek:see:`EventMetadata::add_network_timestamp`
|
|
||||||
## is also set to true.
|
|
||||||
const add_missing_remote_network_timestamp: bool = F &redef;
|
|
||||||
}
|
|
||||||
|
|
||||||
module ConnKey;
|
module ConnKey;
|
||||||
|
|
||||||
export {
|
export {
|
||||||
|
|
@ -659,24 +401,6 @@ export {
|
||||||
const factory = ConnKey::CONNKEY_FIVETUPLE &redef;
|
const factory = ConnKey::CONNKEY_FIVETUPLE &redef;
|
||||||
}
|
}
|
||||||
|
|
||||||
module FTP;
|
|
||||||
|
|
||||||
export {
|
|
||||||
## Limits the size of commands accepted by the FTP analyzer. Longer commands
|
|
||||||
## raise a FTP_max_command_length_exceeded weird and are discarded.
|
|
||||||
const max_command_length = 100 &redef;
|
|
||||||
}
|
|
||||||
|
|
||||||
module SMTP;
|
|
||||||
|
|
||||||
export {
|
|
||||||
## The maximum line length within a BDAT chunk before a forceful linebreak
|
|
||||||
## is introduced and a weird is raised. Conventionally, MIME messages
|
|
||||||
## have a maximum line length of 1000 octets when properly encoded.
|
|
||||||
const bdat_max_line_length = 4096 &redef;
|
|
||||||
}
|
|
||||||
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
module TCP;
|
module TCP;
|
||||||
export {
|
export {
|
||||||
## A TCP Option field parsed from a TCP header.
|
## A TCP Option field parsed from a TCP header.
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,8 @@
|
||||||
@load test-all-policy.zeek
|
@load test-all-policy.zeek
|
||||||
|
|
||||||
# Scripts which are commented out in test-all-policy.zeek.
|
# Scripts which are commented out in test-all-policy.zeek.
|
||||||
<<<<<<< HEAD
|
|
||||||
=======
|
|
||||||
@load frameworks/analyzer/deprecated-dpd-log.zeek
|
|
||||||
@load frameworks/conn_key/vlan_fivetuple.zeek
|
@load frameworks/conn_key/vlan_fivetuple.zeek
|
||||||
|
|
||||||
# Remove in v8.1: replaced by frameworks/analyzer/detect-protocols.zeek
|
|
||||||
@pragma push ignore-deprecations
|
|
||||||
@load frameworks/dpd/detect-protocols.zeek
|
|
||||||
@pragma pop ignore-deprecations
|
|
||||||
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
@load protocols/ssl/decryption.zeek
|
@load protocols/ssl/decryption.zeek
|
||||||
@load frameworks/cluster/nodes-experimental/manager.zeek
|
@load frameworks/cluster/nodes-experimental/manager.zeek
|
||||||
@load frameworks/control/controllee.zeek
|
@load frameworks/control/controllee.zeek
|
||||||
|
|
|
||||||
|
|
@ -173,11 +173,7 @@ gen_zam_target(${GEN_ZAM_SRC_DIR})
|
||||||
option(USE_SQLITE "Should Zeek use SQLite?" ON)
|
option(USE_SQLITE "Should Zeek use SQLite?" ON)
|
||||||
|
|
||||||
add_subdirectory(analyzer)
|
add_subdirectory(analyzer)
|
||||||
<<<<<<< HEAD
|
|
||||||
=======
|
|
||||||
add_subdirectory(conn_key)
|
add_subdirectory(conn_key)
|
||||||
add_subdirectory(cluster)
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
add_subdirectory(packet_analysis)
|
add_subdirectory(packet_analysis)
|
||||||
add_subdirectory(broker)
|
add_subdirectory(broker)
|
||||||
add_subdirectory(telemetry)
|
add_subdirectory(telemetry)
|
||||||
|
|
|
||||||
|
|
@ -48,15 +48,15 @@ Connection::Connection(zeek::IPBasedConnKeyPtr k, double t, uint32_t flow, const
|
||||||
|
|
||||||
#pragma GCC diagnostic push
|
#pragma GCC diagnostic push
|
||||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||||
|
/*
|
||||||
|
* awelzel: This is deprecated and a mess make work, so commented out.
|
||||||
|
*
|
||||||
Connection::Connection(const detail::ConnKey& k, double t, const ConnTuple* id, uint32_t flow, const Packet* pkt)
|
Connection::Connection(const detail::ConnKey& k, double t, const ConnTuple* id, uint32_t flow, const Packet* pkt)
|
||||||
: Session(t, connection_timeout, connection_status_update, detail::connection_status_update_interval) {
|
: Session(t, connection_timeout, connection_status_update, detail::connection_status_update_interval) {
|
||||||
orig_addr = id->src_addr;
|
orig_addr = id->src_addr;
|
||||||
resp_addr = id->dst_addr;
|
resp_addr = id->dst_addr;
|
||||||
orig_port = id->src_port;
|
orig_port = id->src_port;
|
||||||
resp_port = id->dst_port;
|
resp_port = id->dst_port;
|
||||||
<<<<<<< HEAD
|
|
||||||
proto = TRANSPORT_UNKNOWN;
|
|
||||||
=======
|
|
||||||
|
|
||||||
switch ( id->proto ) {
|
switch ( id->proto ) {
|
||||||
case IPPROTO_TCP: proto = TRANSPORT_TCP; break;
|
case IPPROTO_TCP: proto = TRANSPORT_TCP; break;
|
||||||
|
|
@ -72,6 +72,7 @@ Connection::Connection(const detail::ConnKey& k, double t, const ConnTuple* id,
|
||||||
|
|
||||||
Init(flow, pkt);
|
Init(flow, pkt);
|
||||||
}
|
}
|
||||||
|
*/
|
||||||
#pragma GCC diagnostic pop
|
#pragma GCC diagnostic pop
|
||||||
|
|
||||||
Connection::~Connection() {
|
Connection::~Connection() {
|
||||||
|
|
@ -89,7 +90,6 @@ Connection::~Connection() {
|
||||||
}
|
}
|
||||||
|
|
||||||
void Connection::Init(uint32_t flow, const Packet* pkt) {
|
void Connection::Init(uint32_t flow, const Packet* pkt) {
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
orig_flow_label = flow;
|
orig_flow_label = flow;
|
||||||
resp_flow_label = 0;
|
resp_flow_label = 0;
|
||||||
saw_first_orig_packet = 1;
|
saw_first_orig_packet = 1;
|
||||||
|
|
|
||||||
23
src/Conn.h
23
src/Conn.h
|
|
@ -30,15 +30,9 @@ class RecordVal;
|
||||||
using ValPtr = IntrusivePtr<Val>;
|
using ValPtr = IntrusivePtr<Val>;
|
||||||
using RecordValPtr = IntrusivePtr<RecordVal>;
|
using RecordValPtr = IntrusivePtr<RecordVal>;
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
namespace session {
|
|
||||||
class Manager;
|
|
||||||
}
|
|
||||||
=======
|
|
||||||
class IPBasedConnKey;
|
class IPBasedConnKey;
|
||||||
using IPBasedConnKeyPtr = std::unique_ptr<IPBasedConnKey>;
|
using IPBasedConnKeyPtr = std::unique_ptr<IPBasedConnKey>;
|
||||||
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
namespace detail {
|
namespace detail {
|
||||||
|
|
||||||
class Specific_RE_Matcher;
|
class Specific_RE_Matcher;
|
||||||
|
|
@ -66,23 +60,14 @@ enum ConnEventToFlag {
|
||||||
#pragma GCC diagnostic push
|
#pragma GCC diagnostic push
|
||||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||||
struct ConnTuple {
|
struct ConnTuple {
|
||||||
<<<<<<< HEAD
|
|
||||||
IPAddr src_addr;
|
|
||||||
IPAddr dst_addr;
|
|
||||||
uint32_t src_port = 0;
|
|
||||||
uint32_t dst_port = 0;
|
|
||||||
bool is_one_way = false; // if true, don't canonicalize order
|
|
||||||
TransportProto proto = TRANSPORT_UNKNOWN;
|
|
||||||
=======
|
|
||||||
#pragma GCC diagnostic pop
|
#pragma GCC diagnostic pop
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] IPAddr src_addr;
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] IPAddr src_addr;
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] IPAddr dst_addr;
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] IPAddr dst_addr;
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] uint32_t src_port = 0;
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] uint32_t src_port = 0;
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] uint32_t dst_port = 0;
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] uint32_t dst_port = 0;
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] uint16_t proto = UNKNOWN_IP_PROTO;
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] TransportProto transport = TRANSPORT_UNKNOWN;
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] bool is_one_way =
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] bool is_one_way =
|
||||||
false; // if true, don't canonicalize order
|
false; // if true, don't canonicalize order
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
};
|
};
|
||||||
|
|
||||||
static inline int addr_port_canon_lt(const IPAddr& addr1, uint32_t p1, const IPAddr& addr2, uint32_t p2) {
|
static inline int addr_port_canon_lt(const IPAddr& addr1, uint32_t p1, const IPAddr& addr2, uint32_t p2) {
|
||||||
|
|
@ -93,8 +78,10 @@ class Connection final : public session::Session {
|
||||||
public:
|
public:
|
||||||
Connection(zeek::IPBasedConnKeyPtr k, double t, uint32_t flow, const Packet* pkt);
|
Connection(zeek::IPBasedConnKeyPtr k, double t, uint32_t flow, const Packet* pkt);
|
||||||
|
|
||||||
[[deprecated("Remove in v8.1. Switch to ConnKey factories and the new zeek::ConnKey tree.")]]
|
/* awelzel: Commented because it's a hard to make this work and it's deprecated anyhow.
|
||||||
Connection(const detail::ConnKey& k, double t, const ConnTuple* id, uint32_t flow, const Packet* pkt);
|
[[deprecated("Remove in v8.1. Switch to ConnKey factories and the new zeek::ConnKey tree.")]] Connection(
|
||||||
|
const detail::ConnKey& k, double t, const ConnTuple* id, uint32_t flow, const Packet* pkt);
|
||||||
|
*/
|
||||||
|
|
||||||
~Connection() override;
|
~Connection() override;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -67,7 +67,7 @@ protected:
|
||||||
*
|
*
|
||||||
* @param pkt The packet that's currently being processed.
|
* @param pkt The packet that's currently being processed.
|
||||||
*/
|
*/
|
||||||
virtual void DoInit(const Packet& pkt) {};
|
virtual void DoInit(const Packet& pkt){};
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Hook method for ConnKey::PopulateConnIdVal.
|
* Hook method for ConnKey::PopulateConnIdVal.
|
||||||
|
|
|
||||||
3
src/IP.h
3
src/IP.h
|
|
@ -32,6 +32,9 @@ namespace detail {
|
||||||
class FragReassembler;
|
class FragReassembler;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// From Zeek 8.0 for proto support.
|
||||||
|
constexpr uint16_t UNKNOWN_IP_PROTO = 65535;
|
||||||
|
|
||||||
#ifndef IPPROTO_MOBILITY
|
#ifndef IPPROTO_MOBILITY
|
||||||
#define IPPROTO_MOBILITY 135
|
#define IPPROTO_MOBILITY 135
|
||||||
#endif
|
#endif
|
||||||
|
|
|
||||||
|
|
@ -28,7 +28,7 @@ ConnKey::ConnKey(const IPAddr& src, const IPAddr& dst, uint16_t src_port, uint16
|
||||||
#pragma GCC diagnostic push
|
#pragma GCC diagnostic push
|
||||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||||
ConnKey::ConnKey(const ConnTuple& id) {
|
ConnKey::ConnKey(const ConnTuple& id) {
|
||||||
Init(id.src_addr, id.dst_addr, id.src_port, id.dst_port, id.proto, id.is_one_way);
|
Init(id.src_addr, id.dst_addr, id.src_port, id.dst_port, id.transport, id.is_one_way);
|
||||||
}
|
}
|
||||||
|
|
||||||
ConnKey& ConnKey::operator=(const ConnKey& rhs) {
|
ConnKey& ConnKey::operator=(const ConnKey& rhs) {
|
||||||
|
|
|
||||||
12
src/IPAddr.h
12
src/IPAddr.h
|
|
@ -8,6 +8,7 @@
|
||||||
#include <memory>
|
#include <memory>
|
||||||
#include <string>
|
#include <string>
|
||||||
|
|
||||||
|
#include "zeek/net_util.h"
|
||||||
#include "zeek/threading/SerialTypes.h"
|
#include "zeek/threading/SerialTypes.h"
|
||||||
|
|
||||||
using in4_addr = in_addr;
|
using in4_addr = in_addr;
|
||||||
|
|
@ -29,22 +30,15 @@ public:
|
||||||
in6_addr ip2;
|
in6_addr ip2;
|
||||||
uint16_t port1 = 0;
|
uint16_t port1 = 0;
|
||||||
uint16_t port2 = 0;
|
uint16_t port2 = 0;
|
||||||
TransportProto transport = TRANSPORT_UNKNOWN;
|
TransportProto transport = TRANSPORT_UNKNOWN; // awelzel: In 8.0 this is proto. It's not used, so shrug.
|
||||||
bool valid = true;
|
bool valid = true;
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
ConnKey(const IPAddr& src, const IPAddr& dst, uint16_t src_port, uint16_t dst_port, TransportProto t, bool one_way);
|
|
||||||
ConnKey(const ConnTuple& conn);
|
|
||||||
ConnKey(const ConnKey& rhs) { *this = rhs; }
|
|
||||||
ConnKey(Val* v);
|
|
||||||
=======
|
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(const IPAddr& src, const IPAddr& dst,
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(const IPAddr& src, const IPAddr& dst,
|
||||||
uint16_t src_port, uint16_t dst_port,
|
uint16_t src_port, uint16_t dst_port,
|
||||||
uint16_t proto, bool one_way);
|
TransportProto t, bool one_way);
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(const ConnTuple& conn);
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(const ConnTuple& conn);
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(const ConnKey& rhs) { *this = rhs; }
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(const ConnKey& rhs) { *this = rhs; }
|
||||||
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(Val* v);
|
[[deprecated("Remove in v8.1: Switch to new conn_key framework")]] ConnKey(Val* v);
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
|
|
||||||
bool operator<(const ConnKey& rhs) const { return memcmp(this, &rhs, sizeof(ConnKey)) < 0; }
|
bool operator<(const ConnKey& rhs) const { return memcmp(this, &rhs, sizeof(ConnKey)) < 0; }
|
||||||
bool operator<=(const ConnKey& rhs) const { return memcmp(this, &rhs, sizeof(ConnKey)) <= 0; }
|
bool operator<=(const ConnKey& rhs) const { return memcmp(this, &rhs, sizeof(ConnKey)) <= 0; }
|
||||||
|
|
|
||||||
|
|
@ -5,21 +5,13 @@
|
||||||
#include <binpac.h>
|
#include <binpac.h>
|
||||||
#include <algorithm>
|
#include <algorithm>
|
||||||
|
|
||||||
<<<<<<< HEAD
|
#include "zeek/3rdparty/doctest.h"
|
||||||
=======
|
|
||||||
#include "zeek/Conn.h"
|
#include "zeek/Conn.h"
|
||||||
#include "zeek/Event.h"
|
#include "zeek/Event.h"
|
||||||
#include "zeek/analyzer/Manager.h"
|
#include "zeek/analyzer/Manager.h"
|
||||||
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
|
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
|
||||||
#include "zeek/packet_analysis/protocol/tcp/TCPSessionAdapter.h"
|
#include "zeek/packet_analysis/protocol/tcp/TCPSessionAdapter.h"
|
||||||
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
#include "zeek/3rdparty/doctest.h"
|
|
||||||
#include "zeek/Event.h"
|
|
||||||
#include "zeek/ZeekString.h"
|
|
||||||
#include "zeek/analyzer/Manager.h"
|
|
||||||
#include "zeek/analyzer/protocol/pia/PIA.h"
|
|
||||||
|
|
||||||
namespace zeek::analyzer {
|
namespace zeek::analyzer {
|
||||||
|
|
||||||
class AnalyzerTimer final : public zeek::detail::Timer {
|
class AnalyzerTimer final : public zeek::detail::Timer {
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include "zeek/ConnKey.h"
|
#include "zeek/ConnKey.h"
|
||||||
#include "zeek/util-types.h"
|
#include "zeek/util.h"
|
||||||
|
|
||||||
namespace zeek {
|
namespace zeek {
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -22,18 +22,13 @@ bool GTPv1_Analyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
|
||||||
const auto& key = conn->Key();
|
const auto& key = conn->Key();
|
||||||
auto sk = key.SessionKey();
|
auto sk = key.SessionKey();
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
auto cm_it = conn_map.find(conn_key);
|
|
||||||
if ( cm_it == conn_map.end() )
|
|
||||||
cm_it = conn_map.insert(cm_it, {conn_key, std::make_unique<binpac::GTPv1::GTPv1_Conn>(this)});
|
|
||||||
=======
|
|
||||||
auto cm_it = conn_map.find(sk);
|
auto cm_it = conn_map.find(sk);
|
||||||
if ( cm_it == conn_map.end() ) {
|
if ( cm_it == conn_map.end() ) {
|
||||||
sk.CopyData(); // Copy key data to store in map.
|
sk.CopyData(); // Copy key data to store in map.
|
||||||
auto [it, inserted] = conn_map.emplace(std::move(sk), std::make_unique<binpac::GTPv1::GTPv1_Conn>(this));
|
auto [it, inserted] = conn_map.emplace(std::move(sk), std::make_unique<binpac::GTPv1::GTPv1_Conn>(this));
|
||||||
assert(inserted);
|
assert(inserted);
|
||||||
cm_it = it;
|
cm_it = it;
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
}
|
||||||
|
|
||||||
try {
|
try {
|
||||||
cm_it->second->set_raw_packet(packet);
|
cm_it->second->set_raw_packet(packet);
|
||||||
|
|
|
||||||
|
|
@ -38,13 +38,6 @@ bool ICMPAnalyzer::InitConnKey(size_t len, const uint8_t* data, Packet* packet,
|
||||||
if ( ! CheckHeaderTrunc(ICMP_MINLEN, len, packet) )
|
if ( ! CheckHeaderTrunc(ICMP_MINLEN, len, packet) )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
tuple.src_addr = packet->ip_hdr->SrcAddr();
|
|
||||||
tuple.dst_addr = packet->ip_hdr->DstAddr();
|
|
||||||
tuple.proto = TRANSPORT_ICMP;
|
|
||||||
|
|
||||||
=======
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
const struct icmp* icmpp = (const struct icmp*)data;
|
const struct icmp* icmpp = (const struct icmp*)data;
|
||||||
|
|
||||||
uint32_t icmp_counter_type = 0;
|
uint32_t icmp_counter_type = 0;
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
zeek_add_plugin(
|
zeek_add_plugin(
|
||||||
<<<<<<< HEAD
|
|
||||||
PacketAnalyzer
|
PacketAnalyzer
|
||||||
IP
|
IP
|
||||||
SOURCES
|
SOURCES
|
||||||
|
|
@ -7,9 +6,5 @@ zeek_add_plugin(
|
||||||
IPBasedAnalyzer.cc
|
IPBasedAnalyzer.cc
|
||||||
SessionAdapter.cc
|
SessionAdapter.cc
|
||||||
Plugin.cc)
|
Plugin.cc)
|
||||||
=======
|
|
||||||
PacketAnalyzer IP
|
|
||||||
SOURCES IP.cc IPBasedAnalyzer.cc SessionAdapter.cc Plugin.cc)
|
|
||||||
|
|
||||||
add_subdirectory(conn_key)
|
add_subdirectory(conn_key)
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
|
|
|
||||||
|
|
@ -118,8 +118,8 @@ protected:
|
||||||
/**
|
/**
|
||||||
* Parse the header from the packet into a ConnTuple object.
|
* Parse the header from the packet into a ConnTuple object.
|
||||||
*/
|
*/
|
||||||
[[deprecated("Remove in v8.1. Switch to InitConnKey() and key-only initialization.")]]
|
[[deprecated("Remove in v8.1. Switch to InitConnKey() and key-only initialization.")]] virtual bool BuildConnTuple(
|
||||||
virtual bool BuildConnTuple(size_t len, const uint8_t* data, Packet* packet, ConnTuple& tuple) {
|
size_t len, const uint8_t* data, Packet* packet, ConnTuple& tuple) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1 @@
|
||||||
zeek_add_plugin(
|
zeek_add_plugin(Zeek ConnKey_Fivetuple SOURCES Factory.cc Plugin.cc)
|
||||||
Zeek ConnKey_Fivetuple
|
|
||||||
SOURCES Factory.cc Plugin.cc)
|
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,7 @@
|
||||||
#include "zeek/IP.h"
|
#include "zeek/IP.h"
|
||||||
#include "zeek/Val.h"
|
#include "zeek/Val.h"
|
||||||
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
|
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
|
||||||
#include "zeek/util-types.h"
|
#include "zeek/util.h"
|
||||||
|
|
||||||
namespace zeek::conn_key::fivetuple {
|
namespace zeek::conn_key::fivetuple {
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1 @@
|
||||||
zeek_add_plugin(
|
zeek_add_plugin(Zeek Conntuple_VLAN SOURCES Factory.cc Plugin.cc)
|
||||||
Zeek Conntuple_VLAN
|
|
||||||
SOURCES Factory.cc Plugin.cc)
|
|
||||||
|
|
|
||||||
|
|
@ -9,7 +9,7 @@
|
||||||
#include "zeek/iosource/Packet.h"
|
#include "zeek/iosource/Packet.h"
|
||||||
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
|
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
|
||||||
#include "zeek/packet_analysis/protocol/ip/conn_key/fivetuple/Factory.h"
|
#include "zeek/packet_analysis/protocol/ip/conn_key/fivetuple/Factory.h"
|
||||||
#include "zeek/util-types.h"
|
#include "zeek/util.h"
|
||||||
|
|
||||||
namespace zeek::conn_key::vlan_fivetuple {
|
namespace zeek::conn_key::vlan_fivetuple {
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -33,21 +33,8 @@ bool TCPAnalyzer::InitConnKey(size_t len, const uint8_t* data, Packet* packet, I
|
||||||
if ( ! CheckHeaderTrunc(min_hdr_len, len, packet) )
|
if ( ! CheckHeaderTrunc(min_hdr_len, len, packet) )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
tuple.src_addr = packet->ip_hdr->SrcAddr();
|
|
||||||
tuple.dst_addr = packet->ip_hdr->DstAddr();
|
|
||||||
|
|
||||||
data = packet->ip_hdr->Payload();
|
|
||||||
|
|
||||||
const struct tcphdr* tp = (const struct tcphdr*)data;
|
|
||||||
tuple.src_port = tp->th_sport;
|
|
||||||
tuple.dst_port = tp->th_dport;
|
|
||||||
tuple.is_one_way = false;
|
|
||||||
tuple.proto = TRANSPORT_TCP;
|
|
||||||
=======
|
|
||||||
const struct tcphdr* tp = (const struct tcphdr*)packet->ip_hdr->Payload();
|
const struct tcphdr* tp = (const struct tcphdr*)packet->ip_hdr->Payload();
|
||||||
key.InitTuple(packet->ip_hdr->SrcAddr(), tp->th_sport, packet->ip_hdr->DstAddr(), tp->th_dport, packet->proto);
|
key.InitTuple(packet->ip_hdr->SrcAddr(), tp->th_sport, packet->ip_hdr->DstAddr(), tp->th_dport, packet->proto);
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -153,12 +153,8 @@ bool TeredoAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// awelzel: This is the code in 7.0. Creepy.
|
||||||
conn = static_cast<Connection*>(packet->session);
|
conn = static_cast<Connection*>(packet->session);
|
||||||
zeek::detail::ConnKey conn_key = conn->Key();
|
|
||||||
|
|
||||||
OrigRespMap::iterator or_it = orig_resp_map.find(conn_key);
|
|
||||||
if ( or_it == orig_resp_map.end() )
|
|
||||||
or_it = orig_resp_map.insert(or_it, {conn_key, {}});
|
|
||||||
|
|
||||||
detail::TeredoEncapsulation te(this);
|
detail::TeredoEncapsulation te(this);
|
||||||
if ( ! te.Parse(data, len) ) {
|
if ( ! te.Parse(data, len) ) {
|
||||||
|
|
@ -188,8 +184,6 @@ bool TeredoAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
=======
|
|
||||||
const auto& k = conn->Key();
|
const auto& k = conn->Key();
|
||||||
auto sk = k.SessionKey();
|
auto sk = k.SessionKey();
|
||||||
OrigRespMap::iterator or_it = orig_resp_map.find(sk);
|
OrigRespMap::iterator or_it = orig_resp_map.find(sk);
|
||||||
|
|
@ -204,10 +198,9 @@ bool TeredoAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
|
||||||
assert(inserted);
|
assert(inserted);
|
||||||
or_it = it;
|
or_it = it;
|
||||||
|
|
||||||
packet->session->EnqueueEvent(new_teredo_state, nullptr, packet->session->GetVal());
|
// packet->session->EnqueueEvent(new_teredo_state, nullptr, packet->session->GetVal());
|
||||||
}
|
}
|
||||||
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
if ( packet->is_orig )
|
if ( packet->is_orig )
|
||||||
or_it->second.valid_orig = true;
|
or_it->second.valid_orig = true;
|
||||||
else
|
else
|
||||||
|
|
|
||||||
|
|
@ -60,14 +60,7 @@ bool UDPAnalyzer::InitConnKey(size_t len, const uint8_t* data, Packet* packet, I
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
const struct udphdr* up = (const struct udphdr*)packet->ip_hdr->Payload();
|
const struct udphdr* up = (const struct udphdr*)packet->ip_hdr->Payload();
|
||||||
<<<<<<< HEAD
|
|
||||||
tuple.src_port = up->uh_sport;
|
|
||||||
tuple.dst_port = up->uh_dport;
|
|
||||||
tuple.is_one_way = false;
|
|
||||||
tuple.proto = TRANSPORT_UDP;
|
|
||||||
=======
|
|
||||||
key.InitTuple(packet->ip_hdr->SrcAddr(), up->uh_sport, packet->ip_hdr->DstAddr(), up->uh_dport, packet->proto);
|
key.InitTuple(packet->ip_hdr->SrcAddr(), up->uh_sport, packet->ip_hdr->DstAddr(), up->uh_dport, packet->proto);
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -39,21 +39,8 @@ void Component::Describe(ODesc* d) const {
|
||||||
|
|
||||||
case component::SESSION_ADAPTER: d->Add("Session Adapter"); break;
|
case component::SESSION_ADAPTER: d->Add("Session Adapter"); break;
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
=======
|
|
||||||
case component::CLUSTER_BACKEND: d->Add("Cluster Backend"); break;
|
|
||||||
|
|
||||||
case component::EVENT_SERIALIZER: d->Add("Event Serializer"); break;
|
|
||||||
|
|
||||||
case component::LOG_SERIALIZER: d->Add("Log Serializer"); break;
|
|
||||||
|
|
||||||
case component::STORAGE_BACKEND: d->Add("Storage Backend"); break;
|
|
||||||
|
|
||||||
case component::STORAGE_SERIALIZER: d->Add("Storage Serializer"); break;
|
|
||||||
|
|
||||||
case component::CONNKEY: d->Add("ConnKey Factory"); break;
|
case component::CONNKEY: d->Add("ConnKey Factory"); break;
|
||||||
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
default:
|
default:
|
||||||
reporter->InternalWarning("unknown component type in plugin::Component::Describe");
|
reporter->InternalWarning("unknown component type in plugin::Component::Describe");
|
||||||
d->Add("<unknown component type>");
|
d->Add("<unknown component type>");
|
||||||
|
|
|
||||||
|
|
@ -20,7 +20,6 @@ namespace component {
|
||||||
/**
|
/**
|
||||||
* Component types.
|
* Component types.
|
||||||
*/
|
*/
|
||||||
<<<<<<< HEAD
|
|
||||||
enum Type {
|
enum Type {
|
||||||
READER, /// An input reader (not currently used).
|
READER, /// An input reader (not currently used).
|
||||||
WRITER, /// A logging writer (not currently used).
|
WRITER, /// A logging writer (not currently used).
|
||||||
|
|
@ -31,24 +30,7 @@ enum Type {
|
||||||
PKTSRC, /// A packet source.
|
PKTSRC, /// A packet source.
|
||||||
PKTDUMPER, /// A packet dumper.
|
PKTDUMPER, /// A packet dumper.
|
||||||
SESSION_ADAPTER, /// A session adapter analyzer.
|
SESSION_ADAPTER, /// A session adapter analyzer.
|
||||||
=======
|
CONNKEY, /// A factory for connection keys.
|
||||||
enum Type : uint8_t {
|
|
||||||
READER, /// An input reader (not currently used).
|
|
||||||
WRITER, /// A logging writer (not currently used).
|
|
||||||
ANALYZER, /// A protocol analyzer.
|
|
||||||
PACKET_ANALYZER, /// A packet analyzer.
|
|
||||||
FILE_ANALYZER, /// A file analyzer.
|
|
||||||
IOSOURCE, /// An I/O source, excluding packet sources.
|
|
||||||
PKTSRC, /// A packet source.
|
|
||||||
PKTDUMPER, /// A packet dumper.
|
|
||||||
SESSION_ADAPTER, /// A session adapter analyzer.
|
|
||||||
CLUSTER_BACKEND, /// A cluster backend.
|
|
||||||
EVENT_SERIALIZER, /// A serializer for events, used by cluster backends.
|
|
||||||
LOG_SERIALIZER, /// A serializer for log batches, used by cluster backends.
|
|
||||||
STORAGE_BACKEND, /// A backend for the storage framework.
|
|
||||||
STORAGE_SERIALIZER, /// A serializer for the storage framework.
|
|
||||||
CONNKEY, /// A factory for connection keys.
|
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
};
|
};
|
||||||
|
|
||||||
} // namespace component
|
} // namespace component
|
||||||
|
|
|
||||||
|
|
@ -2514,8 +2514,11 @@ type V
|
||||||
eval auto teredo = zeek::packet_mgr->GetAnalyzer("Teredo");
|
eval auto teredo = zeek::packet_mgr->GetAnalyzer("Teredo");
|
||||||
if ( teredo )
|
if ( teredo )
|
||||||
{
|
{
|
||||||
zeek::detail::ConnKey conn_key(frame[z.v1].record_val);
|
auto r = zeek::conn_key_mgr->GetFactory().ConnKeyFromVal(*frame[z.v1].record_val);
|
||||||
static_cast<zeek::packet_analysis::teredo::TeredoAnalyzer*>(teredo.get())->RemoveConnection(conn_key);
|
if ( ! r.has_value() )
|
||||||
|
return zeek::val_mgr->False();
|
||||||
|
auto sk = r.value()->SessionKey();
|
||||||
|
static_cast<zeek::packet_analysis::teredo::TeredoAnalyzer*>(teredo.get())->RemoveConnection(sk);
|
||||||
}
|
}
|
||||||
|
|
||||||
internal-op Remove-Teredo
|
internal-op Remove-Teredo
|
||||||
|
|
@ -2524,8 +2527,11 @@ type VV
|
||||||
eval auto teredo = zeek::packet_mgr->GetAnalyzer("Teredo");
|
eval auto teredo = zeek::packet_mgr->GetAnalyzer("Teredo");
|
||||||
if ( teredo )
|
if ( teredo )
|
||||||
{
|
{
|
||||||
zeek::detail::ConnKey conn_key(frame[z.v2].record_val);
|
auto r = zeek::conn_key_mgr->GetFactory().ConnKeyFromVal(*frame[z.v2].record_val);
|
||||||
static_cast<zeek::packet_analysis::teredo::TeredoAnalyzer*>(teredo.get())->RemoveConnection(conn_key);
|
if ( ! r.has_value() )
|
||||||
|
return zeek::val_mgr->False();
|
||||||
|
auto sk = r.value()->SessionKey();
|
||||||
|
static_cast<zeek::packet_analysis::teredo::TeredoAnalyzer*>(teredo.get())->RemoveConnection(sk);
|
||||||
}
|
}
|
||||||
frame[z.v1].int_val = 1;
|
frame[z.v1].int_val = 1;
|
||||||
|
|
||||||
|
|
@ -2535,8 +2541,11 @@ type V
|
||||||
eval auto gtpv1 = zeek::packet_mgr->GetAnalyzer("GTPv1");
|
eval auto gtpv1 = zeek::packet_mgr->GetAnalyzer("GTPv1");
|
||||||
if ( gtpv1 )
|
if ( gtpv1 )
|
||||||
{
|
{
|
||||||
zeek::detail::ConnKey conn_key(frame[z.v1].record_val);
|
auto r = zeek::conn_key_mgr->GetFactory().ConnKeyFromVal(*frame[z.v1].record_val);
|
||||||
static_cast<zeek::packet_analysis::gtpv1::GTPv1_Analyzer*>(gtpv1.get())->RemoveConnection(conn_key);
|
if ( ! r.has_value() )
|
||||||
|
return zeek::val_mgr->False();
|
||||||
|
auto sk = r.value()->SessionKey();
|
||||||
|
static_cast<zeek::packet_analysis::gtpv1::GTPv1_Analyzer*>(gtpv1.get())->RemoveConnection(sk);
|
||||||
}
|
}
|
||||||
|
|
||||||
internal-op Remove-GTPv1
|
internal-op Remove-GTPv1
|
||||||
|
|
@ -2545,8 +2554,11 @@ type VV
|
||||||
eval auto gtpv1 = zeek::packet_mgr->GetAnalyzer("GTPv1");
|
eval auto gtpv1 = zeek::packet_mgr->GetAnalyzer("GTPv1");
|
||||||
if ( gtpv1 )
|
if ( gtpv1 )
|
||||||
{
|
{
|
||||||
zeek::detail::ConnKey conn_key(frame[z.v2].record_val);
|
auto r = zeek::conn_key_mgr->GetFactory().ConnKeyFromVal(*frame[z.v2].record_val);
|
||||||
static_cast<zeek::packet_analysis::gtpv1::GTPv1_Analyzer*>(gtpv1.get())->RemoveConnection(conn_key);
|
if ( ! r.has_value() )
|
||||||
|
return zeek::val_mgr->False();
|
||||||
|
auto sk = r.value()->SessionKey();
|
||||||
|
static_cast<zeek::packet_analysis::gtpv1::GTPv1_Analyzer*>(gtpv1.get())->RemoveConnection(sk);
|
||||||
}
|
}
|
||||||
frame[z.v1].int_val = 1;
|
frame[z.v1].int_val = 1;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -10,6 +10,7 @@
|
||||||
#include "zeek/Reporter.h"
|
#include "zeek/Reporter.h"
|
||||||
#include "zeek/Traverse.h"
|
#include "zeek/Traverse.h"
|
||||||
#include "zeek/Trigger.h"
|
#include "zeek/Trigger.h"
|
||||||
|
#include "zeek/conn_key/Manager.h"
|
||||||
#include "zeek/script_opt/ScriptOpt.h"
|
#include "zeek/script_opt/ScriptOpt.h"
|
||||||
#include "zeek/script_opt/ZAM/Compile.h"
|
#include "zeek/script_opt/ZAM/Compile.h"
|
||||||
#include "zeek/session/Manager.h"
|
#include "zeek/session/Manager.h"
|
||||||
|
|
|
||||||
|
|
@ -18,12 +18,7 @@
|
||||||
#include "zeek/RunState.h"
|
#include "zeek/RunState.h"
|
||||||
#include "zeek/Timer.h"
|
#include "zeek/Timer.h"
|
||||||
#include "zeek/TunnelEncapsulation.h"
|
#include "zeek/TunnelEncapsulation.h"
|
||||||
<<<<<<< HEAD
|
|
||||||
#include "zeek/analyzer/Manager.h"
|
|
||||||
#include "zeek/iosource/IOSource.h"
|
|
||||||
=======
|
|
||||||
#include "zeek/conn_key/Manager.h"
|
#include "zeek/conn_key/Manager.h"
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
#include "zeek/packet_analysis/Manager.h"
|
#include "zeek/packet_analysis/Manager.h"
|
||||||
#include "zeek/session/Session.h"
|
#include "zeek/session/Session.h"
|
||||||
#include "zeek/telemetry/Manager.h"
|
#include "zeek/telemetry/Manager.h"
|
||||||
|
|
@ -95,14 +90,10 @@ Connection* Manager::FindConnection(Val* v) {
|
||||||
// different builder.
|
// different builder.
|
||||||
auto r = conn_key_mgr->GetFactory().ConnKeyFromVal(*v);
|
auto r = conn_key_mgr->GetFactory().ConnKeyFromVal(*v);
|
||||||
|
|
||||||
<<<<<<< HEAD
|
|
||||||
if ( ! conn_key.valid )
|
|
||||||
=======
|
|
||||||
if ( ! r.has_value() ) {
|
if ( ! r.has_value() ) {
|
||||||
// Produce a loud error for invalid script-layer conn_id records.
|
|
||||||
zeek::emit_builtin_error(r.error().c_str());
|
zeek::emit_builtin_error(r.error().c_str());
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
return nullptr;
|
return nullptr;
|
||||||
|
}
|
||||||
|
|
||||||
return FindConnection(*r.value());
|
return FindConnection(*r.value());
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -54,12 +54,7 @@
|
||||||
#include "zeek/analyzer/Manager.h"
|
#include "zeek/analyzer/Manager.h"
|
||||||
#include "zeek/binpac_zeek.h"
|
#include "zeek/binpac_zeek.h"
|
||||||
#include "zeek/broker/Manager.h"
|
#include "zeek/broker/Manager.h"
|
||||||
<<<<<<< HEAD
|
|
||||||
=======
|
|
||||||
#include "zeek/cluster/Backend.h"
|
|
||||||
#include "zeek/cluster/Manager.h"
|
|
||||||
#include "zeek/conn_key/Manager.h"
|
#include "zeek/conn_key/Manager.h"
|
||||||
>>>>>>> cd934c460b (Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples')
|
|
||||||
#include "zeek/file_analysis/Manager.h"
|
#include "zeek/file_analysis/Manager.h"
|
||||||
#include "zeek/input.h"
|
#include "zeek/input.h"
|
||||||
#include "zeek/input/Manager.h"
|
#include "zeek/input/Manager.h"
|
||||||
|
|
|
||||||
|
|
@ -4,12 +4,12 @@ warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__lo
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:150 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:150 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
|
|
|
||||||
|
|
@ -1,21 +1,21 @@
|
||||||
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:150 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
received termination signal
|
received termination signal
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:150 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
received termination signal
|
received termination signal
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:150 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
received termination signal
|
received termination signal
|
||||||
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:150 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general.";
|
||||||
received termination signal
|
received termination signal
|
||||||
|
|
|
||||||
|
|
@ -5,11 +5,31 @@ Demo::Foo - A Foo ConnKey factory (dynamic, version 1.0.0)
|
||||||
===
|
===
|
||||||
DoNewConnKey (0 key all_inits)
|
DoNewConnKey (0 key all_inits)
|
||||||
DoNewConnKey (1 key all_inits)
|
DoNewConnKey (1 key all_inits)
|
||||||
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=50003/tcp, resp_h=199.233.217.249, resp_p=21/tcp, proto=6, inits=0]
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=50003/tcp, resp_h=199.233.217.249, resp_p=21/tcp, inits=0]
|
||||||
DoNewConnKey (2 key all_inits)
|
DoNewConnKey (2 key all_inits)
|
||||||
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=50003/tcp, resp_h=199.233.217.249, resp_p=21/tcp, proto=6, inits=0]
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=50003/tcp, resp_h=199.233.217.249, resp_p=21/tcp, inits=0]
|
||||||
DoNewConnKey (6 key all_inits)
|
DoNewConnKey (6 key all_inits)
|
||||||
DoNewConnKey (22 key all_inits)
|
DoNewConnKey (22 key all_inits)
|
||||||
DoNewConnKey (40 key all_inits)
|
DoNewConnKey (40 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=37604/tcp, resp_h=199.233.217.249, resp_p=56666/tcp, inits=1]
|
||||||
|
DoNewConnKey (53 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=37604/tcp, resp_h=199.233.217.249, resp_p=56666/tcp, inits=1]
|
||||||
|
DoNewConnKey (53 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=59378/tcp, resp_h=199.233.217.249, resp_p=56667/tcp, inits=22]
|
||||||
|
DoNewConnKey (54 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=59378/tcp, resp_h=199.233.217.249, resp_p=56667/tcp, inits=22]
|
||||||
|
DoNewConnKey (54 key all_inits)
|
||||||
DoNewConnKey (60 key all_inits)
|
DoNewConnKey (60 key all_inits)
|
||||||
DoNewConnKey (78 key all_inits)
|
DoNewConnKey (78 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=199.233.217.249, orig_p=61920/tcp, resp_h=141.142.220.235, resp_p=33582/tcp, inits=40]
|
||||||
|
DoNewConnKey (90 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=199.233.217.249, orig_p=61920/tcp, resp_h=141.142.220.235, resp_p=33582/tcp, inits=40]
|
||||||
|
DoNewConnKey (90 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=199.233.217.249, orig_p=61918/tcp, resp_h=141.142.220.235, resp_p=37835/tcp, inits=60]
|
||||||
|
DoNewConnKey (95 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=199.233.217.249, orig_p=61918/tcp, resp_h=141.142.220.235, resp_p=37835/tcp, inits=60]
|
||||||
|
DoNewConnKey (95 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=50003/tcp, resp_h=199.233.217.249, resp_p=21/tcp, inits=0]
|
||||||
|
DoNewConnKey (95 key all_inits)
|
||||||
|
DoConnKeyFromVal for [orig_h=141.142.220.235, orig_p=50003/tcp, resp_h=199.233.217.249, resp_p=21/tcp, inits=0]
|
||||||
|
DoNewConnKey (95 key all_inits)
|
||||||
|
|
|
||||||
|
|
@ -10,6 +10,4 @@ set(CMAKE_MODULE_PATH ${ZEEK_DIST}/cmake)
|
||||||
|
|
||||||
include(ZeekPlugin)
|
include(ZeekPlugin)
|
||||||
|
|
||||||
zeek_add_plugin(
|
zeek_add_plugin(Demo Foo SOURCES src/Plugin.cc src/Foo.cc)
|
||||||
Demo Foo
|
|
||||||
SOURCES src/Plugin.cc src/Foo.cc)
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue