Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add filter_subnet_table bif

Browse source 
This bif works similar to the matching_subnet bif. The difference is
that, instead of returning a vector of the subnets that match, we return
a filtered view of the original set/table only containing the changed
subnets.

This commit also fixes a small bug in TableVal::UpdateTimestamp
(ReadOperation only has to be called when LoggingAccess() is true).
This commit is contained in:
Johanna Amann 2016-03-16 15:50:13 -07:00
parent f5ce4785ea
commit a6cb85d86a
7 changed files with 153 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

20
testing/btest/Baseline/bifs.filter_subnet_table/output Normal file
View file

@ -0,0 +1,20 @@
{
10.0.0.0/8,
10.2.0.2/31,
10.2.0.0/16
}
{
[10.0.0.0/8] = a,
[10.2.0.2/31] = c,
[10.2.0.0/16] = b
}
{
[10.0.0.0/8] = a,
[10.3.0.0/16] = e
}
{
}
{
}

49
testing/btest/bifs/filter_subnet_table.bro Normal file
View file

@ -0,0 +1,49 @@
# @TEST-EXEC: bro -b %INPUT >output
# @TEST-EXEC: btest-diff output
global testa: set[subnet] = {
10.0.0.0/8,
10.2.0.0/16,
10.2.0.2/31,
10.1.0.0/16,
10.3.0.0/16,
5.0.0.0/8,
5.5.0.0/25,
5.2.0.0/32,
7.2.0.0/32,
[2607:f8b0:4008:807::200e]/64,
[2607:f8b0:4007:807::200e]/64,
[2607:f8b0:4007:807::200e]/128
};
global testb: table[subnet] of string = {
[10.0.0.0/8] = "a",
[10.2.0.0/16] = "b",
[10.2.0.2/31] = "c",
[10.1.0.0/16] = "d",
[10.3.0.0/16] = "e",
[5.0.0.0/8] = "f",
[5.5.0.0/25] = "g",
[5.2.0.0/32] = "h",
[7.2.0.0/32] = "i",
[[2607:f8b0:4008:807::200e]/64] = "j",
[[2607:f8b0:4007:807::200e]/64] = "k",
[[2607:f8b0:4007:807::200e]/128] = "l"
};
event bro_init()
{
local c = filter_subnet_table(10.2.0.2/32, testa);
print c;
c = filter_subnet_table(10.2.0.2/32, testb);
print c;
c = filter_subnet_table(10.3.0.2/32, testb);
print c;
c = filter_subnet_table(1.0.0.0/8, testb);
print c;
local unspecified: table[subnet] of string = table();
c = filter_subnet_table(10.2.0.2/32, unspecified);
print c;
}