Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

mask_addr bif now returns subnet (addresses #512)

Browse source
This commit is contained in:
Jon Siwek 2011-07-23 16:45:29 -05:00
parent 64bc53e621
commit b6a371f32d
5 changed files with 47 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
policy/frameworks/metrics/base/main.bro
View file

@ -122,8 +122,7 @@ function add_data(name: ID, index: Index, increment: count)
if ( conf?$aggregation_mask ) if ( conf?$aggregation_mask )
{ {
local agg_mask = conf$aggregation_mask; local agg_mask = conf$aggregation_mask;
local agg = mask_addr(index$host, agg_mask); agg_subnet = fmt("%s", mask_addr(index$host, agg_mask));
agg_subnet = fmt("%s/%d", agg, agg_mask);
} }
else if ( conf?$aggregation_table ) else if ( conf?$aggregation_table )
agg_subnet = fmt("%s", conf$aggregation_table[index$host]); agg_subnet = fmt("%s", conf$aggregation_table[index$host]);

6
policy/utils/site.bro
View file

@ -97,13 +97,13 @@ function find_all_emails(ip: addr): set[string]
if ( ip !in local_admins ) return set(); if ( ip !in local_admins ) return set();
local output_values: set[string] = set(); local output_values: set[string] = set();
local tmp_ip: addr; local tmp_subnet: subnet;
local i: count; local i: count;
local emails: string; local emails: string;
for ( i in one_to_32 ) for ( i in one_to_32 )
{ {
tmp_ip = mask_addr(ip, one_to_32[i]); tmp_subnet = mask_addr(ip, one_to_32[i]);
for ( email in local_admins[tmp_ip] ) for ( email in local_admins[tmp_subnet] )
{ {
if ( email != "" ) if ( email != "" )
add output_values[email]; add output_values[email];

4
src/bro.bif
View file

@ -639,9 +639,9 @@ function to_port%(num: count, proto: transport_proto%): port
return new PortVal(num, (TransportProto)proto->AsEnum()); return new PortVal(num, (TransportProto)proto->AsEnum());
%} %}
function mask_addr%(a: addr, top_bits_to_keep: count%): addr function mask_addr%(a: addr, top_bits_to_keep: count%): subnet
%{ %{
return new AddrVal(mask_addr(a, top_bits_to_keep)); return new SubNetVal(mask_addr(a, top_bits_to_keep), top_bits_to_keep);
%} %}
# Take some top bits (e.g. subnet address) from a1 and the other # Take some top bits (e.g. subnet address) from a1 and the other

32
testing/btest/Baseline/bifs.mask_addr/output Normal file
View file

@ -0,0 +1,32 @@
128.0.0.0/1
192.0.0.0/2
224.0.0.0/3
240.0.0.0/4
248.0.0.0/5
252.0.0.0/6
254.0.0.0/7
255.0.0.0/8
255.128.0.0/9
255.192.0.0/10
255.224.0.0/11
255.240.0.0/12
255.248.0.0/13
255.252.0.0/14
255.254.0.0/15
255.255.0.0/16
255.255.128.0/17
255.255.192.0/18
255.255.224.0/19
255.255.240.0/20
255.255.248.0/21
255.255.252.0/22
255.255.254.0/23
255.255.255.0/24
255.255.255.128/25
255.255.255.192/26
255.255.255.224/27
255.255.255.240/28
255.255.255.248/29
255.255.255.252/30
255.255.255.254/31
255.255.255.255/32

9
testing/btest/bifs/mask_addr.bro Normal file
View file

@ -0,0 +1,9 @@
# @TEST-EXEC: bro %INPUT >output
# @TEST-EXEC: btest-diff output
const one_to_32: vector of count = {1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32};
for ( i in one_to_32 )
{
print mask_addr(255.255.255.255, one_to_32[i]);
}