Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge commit '1a327cd355' into topic/policy-scripts-new

Browse source 
* commit '1a327cd355':
  Moved events for filling in connection service field to dpd.bro
This commit is contained in:
Seth Hall 2011-03-16 17:00:46 -04:00
commit a876c4c7cf
4 changed files with 20 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

19
policy.old/conn.bro
View file

@ -310,25 +310,6 @@ function record_connection(f: file, c: connection)
print f, log_msg;
}
event protocol_confirmation(c: connection, atype: count, aid: count)
{
if ( ! dpd_conn_logs )
return;
delete c$service[fmt("-%s",analyzer_name(atype))];
add c$service[analyzer_name(atype)];
}
event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority = 10
{
if ( ! dpd_conn_logs )
return;
delete c$service[analyzer_name(atype)];
add c$service[fmt("-%s",analyzer_name(atype))];
}
event connection_established(c: connection)
{
Hot::check_hot(c, Hot::CONN_ESTABLISHED);

5
policy.old/dpd.bro
View file

@ -1,5 +0,0 @@
# $Id: dpd.bro,v 1.1.2.1 2006/05/10 02:10:26 sommer Exp $
#
# Activates port-independent protocol detection.
redef signature_files += "dpd.sig";

20
policy/dpd.bro Normal file
View file

@ -0,0 +1,20 @@
# $Id: dpd.bro,v 1.1.2.1 2006/05/10 02:10:26 sommer Exp $
#
# Activates port-independent protocol detection.
redef signature_files += "dpd.sig";
event protocol_confirmation(c: connection, atype: count, aid: count)
{
delete c$service[fmt("-%s",analyzer_name(atype))];
add c$service[analyzer_name(atype)];
}
event protocol_violation(c: connection, atype: count, aid: count,
reason: string) &priority = 10
{
delete c$service[analyzer_name(atype)];
add c$service[fmt("-%s",analyzer_name(atype))];
}

0
policy.old/sigs/dpd.sig → policy/sigs/dpd.sig
View file