Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'zeek:master' into master

Browse source
This commit is contained in:
Fatema BW 2022-08-11 18:20:31 -07:00 • committed by GitHub
commit d9632631ce
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
243 changed files with 44421 additions and 20773 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/init-bare.zeek
View file

@ -588,6 +588,23 @@ type fa_metadata: record {
inferred: bool &default=T;
};
## A hook taking a connection, analyzer tag and analyzer id that can be
## used to veto disabling analyzers. Specifically, an analyzer can be prevented
## from being disabled by using a :zeek:see:`break` statement within the hook.
## This hook is invoked synchronously during a :zeek:see:`disable_analyzer` call.
##
## Scripts implementing this hook should have other logic that will eventually
## disable the analyzer for the given connection. That is, if a script vetoes
## disabling an analyzer, it takes responsibility for a later call to
## :zeek:see:`disable_analyzer`, which may be never.
##
## c: The connection
##
## atype: The type / tag of the analyzer being disabled.
##
## aid: The analyzer ID.
type disabling_analyzer: hook(c: connection, atype: AllAnalyzers::Tag, aid: count);
## Fields of a SYN packet.
##
## .. zeek:see:: connection_SYN_packet