policy: Import zeek-community-id scripts into protocols/conn frameworks/notice

Slightly adapted for indentation.
This commit is contained in:
Christian Kreibich 2023-04-21 19:24:02 +02:00 committed by Arne Welzel
parent 99de7b7526
commit b90351b7e6
8 changed files with 111 additions and 0 deletions

View file

@ -0,0 +1,26 @@
##! Adds community hash IDs to conn.log.
@load base/protocols/conn
module CommunityID;
export {
# An unsigned 16-bit number to seed our hashing
option seed: count = 0;
# Whether to add a base64 pass over the hash digest.
# Enabled by default, since it shortens the output.
option do_base64: bool = T;
# Add the ID string field to the connection log record.
redef record Conn::Info += {
community_id: string &optional &log;
};
}
module Conn;
event new_connection(c: connection)
{
Conn::set_conn(c, F); # likely first to access :-/
c$conn$community_id = community_id_v1(c$id, CommunityID::seed, CommunityID::do_base64);
}