mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
policy: Import zeek-community-id scripts into protocols/conn frameworks/notice
Slightly adapted for indentation.
This commit is contained in:
parent
99de7b7526
commit
b90351b7e6
8 changed files with 111 additions and 0 deletions
26
scripts/policy/protocols/conn/community-id-logging.zeek
Normal file
26
scripts/policy/protocols/conn/community-id-logging.zeek
Normal file
|
@ -0,0 +1,26 @@
|
|||
##! Adds community hash IDs to conn.log.
|
||||
@load base/protocols/conn
|
||||
|
||||
module CommunityID;
|
||||
|
||||
export {
|
||||
# An unsigned 16-bit number to seed our hashing
|
||||
option seed: count = 0;
|
||||
|
||||
# Whether to add a base64 pass over the hash digest.
|
||||
# Enabled by default, since it shortens the output.
|
||||
option do_base64: bool = T;
|
||||
|
||||
# Add the ID string field to the connection log record.
|
||||
redef record Conn::Info += {
|
||||
community_id: string &optional &log;
|
||||
};
|
||||
}
|
||||
|
||||
module Conn;
|
||||
|
||||
event new_connection(c: connection)
|
||||
{
|
||||
Conn::set_conn(c, F); # likely first to access :-/
|
||||
c$conn$community_id = community_id_v1(c$id, CommunityID::seed, CommunityID::do_base64);
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue