mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 17:18:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/johanna/ocsp
This commit is contained in:
Johanna Amann
commit
da9b5425e4
157 changed files with 1830 additions and 1130 deletions
|
|
@ -43,35 +43,35 @@ export {
|
|||
## software.
|
||||
TIME_MACHINE,
|
||||
};
|
||||
|
||||
|
||||
## Events raised by a manager and handled by the workers.
|
||||
const manager2worker_events = /Drop::.*/ &redef;
|
||||
|
||||
|
||||
## Events raised by a manager and handled by proxies.
|
||||
const manager2proxy_events = /EMPTY/ &redef;
|
||||
|
||||
|
||||
## Events raised by proxies and handled by a manager.
|
||||
const proxy2manager_events = /EMPTY/ &redef;
|
||||
|
||||
|
||||
## Events raised by proxies and handled by workers.
|
||||
const proxy2worker_events = /EMPTY/ &redef;
|
||||
|
||||
|
||||
## Events raised by workers and handled by a manager.
|
||||
const worker2manager_events = /(TimeMachine::command|Drop::.*)/ &redef;
|
||||
|
||||
|
||||
## Events raised by workers and handled by proxies.
|
||||
const worker2proxy_events = /EMPTY/ &redef;
|
||||
|
||||
|
||||
## Events raised by TimeMachine instances and handled by a manager.
|
||||
const tm2manager_events = /EMPTY/ &redef;
|
||||
|
||||
|
||||
## Events raised by TimeMachine instances and handled by workers.
|
||||
const tm2worker_events = /EMPTY/ &redef;
|
||||
|
||||
## Events sent by the control host (i.e. BroControl) when dynamically
|
||||
|
||||
## Events sent by the control host (i.e. BroControl) when dynamically
|
||||
## connecting to a running instance to update settings or request data.
|
||||
const control_events = Control::controller_events &redef;
|
||||
|
||||
|
||||
## Record type to indicate a node in a cluster.
|
||||
type Node: record {
|
||||
## Identifies the type of cluster node in this node's configuration.
|
||||
|
|
@ -96,13 +96,13 @@ export {
|
|||
## Name of a time machine node with which this node connects.
|
||||
time_machine: string &optional;
|
||||
};
|
||||
|
||||
|
||||
## This function can be called at any time to determine if the cluster
|
||||
## framework is being enabled for this run.
|
||||
##
|
||||
## Returns: True if :bro:id:`Cluster::node` has been set.
|
||||
global is_enabled: function(): bool;
|
||||
|
||||
|
||||
## This function can be called at any time to determine what type of
|
||||
## cluster node the current Bro instance is going to be acting as.
|
||||
## If :bro:id:`Cluster::is_enabled` returns false, then
|
||||
|
|
@ -110,22 +110,25 @@ export {
|
|||
##
|
||||
## Returns: The :bro:type:`Cluster::NodeType` the calling node acts as.
|
||||
global local_node_type: function(): NodeType;
|
||||
|
||||
|
||||
## This gives the value for the number of workers currently connected to,
|
||||
## and it's maintained internally by the cluster framework. It's
|
||||
## primarily intended for use by managers to find out how many workers
|
||||
## and it's maintained internally by the cluster framework. It's
|
||||
## primarily intended for use by managers to find out how many workers
|
||||
## should be responding to requests.
|
||||
global worker_count: count = 0;
|
||||
|
||||
|
||||
## The cluster layout definition. This should be placed into a filter
|
||||
## named cluster-layout.bro somewhere in the BROPATH. It will be
|
||||
## named cluster-layout.bro somewhere in the BROPATH. It will be
|
||||
## automatically loaded if the CLUSTER_NODE environment variable is set.
|
||||
## Note that BroControl handles all of this automatically.
|
||||
const nodes: table[string] of Node = {} &redef;
|
||||
|
||||
|
||||
## This is usually supplied on the command line for each instance
|
||||
## of the cluster that is started up.
|
||||
const node = getenv("CLUSTER_NODE") &redef;
|
||||
|
||||
## Interval for retrying failed connections between cluster nodes.
|
||||
const retry_interval = 1min &redef;
|
||||
}
|
||||
|
||||
function is_enabled(): bool
|
||||
|
|
@ -158,6 +161,6 @@ event bro_init() &priority=5
|
|||
Reporter::error(fmt("'%s' is not a valid node in the Cluster::nodes configuration", node));
|
||||
terminate();
|
||||
}
|
||||
|
||||
|
||||
Log::create_stream(Cluster::LOG, [$columns=Info, $path="cluster"]);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ module Cluster;
|
|||
event bro_init() &priority=9
|
||||
{
|
||||
local me = nodes[node];
|
||||
|
||||
|
||||
for ( i in Cluster::nodes )
|
||||
{
|
||||
local n = nodes[i];
|
||||
|
|
@ -22,35 +22,35 @@ event bro_init() &priority=9
|
|||
Communication::nodes["control"] = [$host=n$ip, $zone_id=n$zone_id,
|
||||
$connect=F, $class="control",
|
||||
$events=control_events];
|
||||
|
||||
|
||||
if ( me$node_type == MANAGER )
|
||||
{
|
||||
if ( n$node_type == WORKER && n$manager == node )
|
||||
Communication::nodes[i] =
|
||||
[$host=n$ip, $zone_id=n$zone_id, $connect=F,
|
||||
$class=i, $events=worker2manager_events, $request_logs=T];
|
||||
|
||||
|
||||
if ( n$node_type == PROXY && n$manager == node )
|
||||
Communication::nodes[i] =
|
||||
[$host=n$ip, $zone_id=n$zone_id, $connect=F,
|
||||
$class=i, $events=proxy2manager_events, $request_logs=T];
|
||||
|
||||
|
||||
if ( n$node_type == TIME_MACHINE && me?$time_machine && me$time_machine == i )
|
||||
Communication::nodes["time-machine"] = [$host=nodes[i]$ip,
|
||||
$zone_id=nodes[i]$zone_id,
|
||||
$p=nodes[i]$p,
|
||||
$connect=T, $retry=1min,
|
||||
$connect=T, $retry=retry_interval,
|
||||
$events=tm2manager_events];
|
||||
}
|
||||
|
||||
|
||||
else if ( me$node_type == PROXY )
|
||||
{
|
||||
if ( n$node_type == WORKER && n$proxy == node )
|
||||
Communication::nodes[i] =
|
||||
[$host=n$ip, $zone_id=n$zone_id, $connect=F, $class=i,
|
||||
$sync=T, $auth=T, $events=worker2proxy_events];
|
||||
|
||||
# accepts connections from the previous one.
|
||||
|
||||
# accepts connections from the previous one.
|
||||
# (This is not ideal for setups with many proxies)
|
||||
# FIXME: Once we're using multiple proxies, we should also figure out some $class scheme ...
|
||||
if ( n$node_type == PROXY )
|
||||
|
|
@ -58,49 +58,49 @@ event bro_init() &priority=9
|
|||
if ( n?$proxy )
|
||||
Communication::nodes[i]
|
||||
= [$host=n$ip, $zone_id=n$zone_id, $p=n$p,
|
||||
$connect=T, $auth=F, $sync=T, $retry=1mins];
|
||||
$connect=T, $auth=F, $sync=T, $retry=retry_interval];
|
||||
else if ( me?$proxy && me$proxy == i )
|
||||
Communication::nodes[me$proxy]
|
||||
= [$host=nodes[i]$ip, $zone_id=nodes[i]$zone_id,
|
||||
$connect=F, $auth=T, $sync=T];
|
||||
}
|
||||
|
||||
|
||||
# Finally the manager, to send it status updates.
|
||||
if ( n$node_type == MANAGER && me$manager == i )
|
||||
Communication::nodes["manager"] = [$host=nodes[i]$ip,
|
||||
$zone_id=nodes[i]$zone_id,
|
||||
$p=nodes[i]$p,
|
||||
$connect=T, $retry=1mins,
|
||||
Communication::nodes["manager"] = [$host=nodes[i]$ip,
|
||||
$zone_id=nodes[i]$zone_id,
|
||||
$p=nodes[i]$p,
|
||||
$connect=T, $retry=retry_interval,
|
||||
$class=node,
|
||||
$events=manager2proxy_events];
|
||||
}
|
||||
else if ( me$node_type == WORKER )
|
||||
{
|
||||
if ( n$node_type == MANAGER && me$manager == i )
|
||||
Communication::nodes["manager"] = [$host=nodes[i]$ip,
|
||||
Communication::nodes["manager"] = [$host=nodes[i]$ip,
|
||||
$zone_id=nodes[i]$zone_id,
|
||||
$p=nodes[i]$p,
|
||||
$connect=T, $retry=1mins,
|
||||
$class=node,
|
||||
$connect=T, $retry=retry_interval,
|
||||
$class=node,
|
||||
$events=manager2worker_events];
|
||||
|
||||
|
||||
if ( n$node_type == PROXY && me$proxy == i )
|
||||
Communication::nodes["proxy"] = [$host=nodes[i]$ip,
|
||||
Communication::nodes["proxy"] = [$host=nodes[i]$ip,
|
||||
$zone_id=nodes[i]$zone_id,
|
||||
$p=nodes[i]$p,
|
||||
$connect=T, $retry=1mins,
|
||||
$sync=T, $class=node,
|
||||
$connect=T, $retry=retry_interval,
|
||||
$sync=T, $class=node,
|
||||
$events=proxy2worker_events];
|
||||
|
||||
if ( n$node_type == TIME_MACHINE &&
|
||||
|
||||
if ( n$node_type == TIME_MACHINE &&
|
||||
me?$time_machine && me$time_machine == i )
|
||||
Communication::nodes["time-machine"] = [$host=nodes[i]$ip,
|
||||
Communication::nodes["time-machine"] = [$host=nodes[i]$ip,
|
||||
$zone_id=nodes[i]$zone_id,
|
||||
$p=nodes[i]$p,
|
||||
$connect=T,
|
||||
$retry=1min,
|
||||
$connect=T,
|
||||
$retry=retry_interval,
|
||||
$events=tm2worker_events];
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -71,6 +71,14 @@ signature file-mp2p {
|
|||
file-magic /\x00\x00\x01\xba([\x40-\x7f\xc0-\xff])/
|
||||
}
|
||||
|
||||
# MPEG transport stream data. These files typically have the extension "ts".
|
||||
# Note: The 0x47 repeats every 188 bytes. Using four as the number of
|
||||
# occurrences for the test here is arbitrary.
|
||||
signature file-mp2t {
|
||||
file-mime "video/mp2t", 40
|
||||
file-magic /^(\x47.{187}){4}/
|
||||
}
|
||||
|
||||
# Silicon Graphics video
|
||||
signature file-sgi-movie {
|
||||
file-mime "video/x-sgi-movie", 70
|
||||
|
|
@ -94,3 +102,4 @@ signature file-3gpp {
|
|||
file-mime "video/3gpp", 60
|
||||
file-magic /^....ftyp(3g[egps2]|avc1|mmp4)/
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,18 +1,25 @@
|
|||
##! The input framework provides a way to read previously stored data either
|
||||
##! as an event stream or into a bro table.
|
||||
##! as an event stream or into a Bro table.
|
||||
|
||||
module Input;
|
||||
|
||||
export {
|
||||
type Event: enum {
|
||||
## New data has been imported.
|
||||
EVENT_NEW = 0,
|
||||
## Existing data has been changed.
|
||||
EVENT_CHANGED = 1,
|
||||
## Previously existing data has been removed.
|
||||
EVENT_REMOVED = 2,
|
||||
};
|
||||
|
||||
## Type that defines the input stream read mode.
|
||||
type Mode: enum {
|
||||
## Do not automatically reread the file after it has been read.
|
||||
MANUAL = 0,
|
||||
## Reread the entire file each time a change is found.
|
||||
REREAD = 1,
|
||||
## Read data from end of file each time new data is appended.
|
||||
STREAM = 2
|
||||
};
|
||||
|
||||
|
|
@ -24,20 +31,20 @@ export {
|
|||
|
||||
## Separator between fields.
|
||||
## Please note that the separator has to be exactly one character long.
|
||||
## Can be overwritten by individual writers.
|
||||
## Individual readers can use a different value.
|
||||
const separator = "\t" &redef;
|
||||
|
||||
## Separator between set elements.
|
||||
## Please note that the separator has to be exactly one character long.
|
||||
## Can be overwritten by individual writers.
|
||||
## Individual readers can use a different value.
|
||||
const set_separator = "," &redef;
|
||||
|
||||
## String to use for empty fields.
|
||||
## Can be overwritten by individual writers.
|
||||
## Individual readers can use a different value.
|
||||
const empty_field = "(empty)" &redef;
|
||||
|
||||
## String to use for an unset &optional field.
|
||||
## Can be overwritten by individual writers.
|
||||
## Individual readers can use a different value.
|
||||
const unset_field = "-" &redef;
|
||||
|
||||
## Flag that controls if the input framework accepts records
|
||||
|
|
@ -47,11 +54,11 @@ export {
|
|||
## abort. Defaults to false (abort).
|
||||
const accept_unsupported_types = F &redef;
|
||||
|
||||
## TableFilter description type used for the `table` method.
|
||||
## A table input stream type used to send data to a Bro table.
|
||||
type TableDescription: record {
|
||||
# Common definitions for tables and events
|
||||
|
||||
## String that allows the reader to find the source.
|
||||
## String that allows the reader to find the source of the data.
|
||||
## For `READER_ASCII`, this is the filename.
|
||||
source: string;
|
||||
|
||||
|
|
@ -61,7 +68,8 @@ export {
|
|||
## Read mode to use for this stream.
|
||||
mode: Mode &default=default_mode;
|
||||
|
||||
## Descriptive name. Used to remove a stream at a later time.
|
||||
## Name of the input stream. This is used by some functions to
|
||||
## manipulate the stream.
|
||||
name: string;
|
||||
|
||||
# Special definitions for tables
|
||||
|
|
@ -73,31 +81,35 @@ export {
|
|||
idx: any;
|
||||
|
||||
## Record that defines the values used as the elements of the table.
|
||||
## If this is undefined, then *destination* has to be a set.
|
||||
## If this is undefined, then *destination* must be a set.
|
||||
val: any &optional;
|
||||
|
||||
## Defines if the value of the table is a record (default), or a single value.
|
||||
## When this is set to false, then *val* can only contain one element.
|
||||
## Defines if the value of the table is a record (default), or a single
|
||||
## value. When this is set to false, then *val* can only contain one
|
||||
## element.
|
||||
want_record: bool &default=T;
|
||||
|
||||
## The event that is raised each time a value is added to, changed in or removed
|
||||
## from the table. The event will receive an Input::Event enum as the first
|
||||
## argument, the *idx* record as the second argument and the value (record) as the
|
||||
## third argument.
|
||||
ev: any &optional; # event containing idx, val as values.
|
||||
## The event that is raised each time a value is added to, changed in,
|
||||
## or removed from the table. The event will receive an
|
||||
## Input::TableDescription as the first argument, an Input::Event
|
||||
## enum as the second argument, the *idx* record as the third argument
|
||||
## and the value (record) as the fourth argument.
|
||||
ev: any &optional;
|
||||
|
||||
## Predicate function that can decide if an insertion, update or removal should
|
||||
## really be executed. Parameters are the same as for the event. If true is
|
||||
## returned, the update is performed. If false is returned, it is skipped.
|
||||
## Predicate function that can decide if an insertion, update or removal
|
||||
## should really be executed. Parameters have same meaning as for the
|
||||
## event.
|
||||
## If true is returned, the update is performed. If false is returned,
|
||||
## it is skipped.
|
||||
pred: function(typ: Input::Event, left: any, right: any): bool &optional;
|
||||
|
||||
## A key/value table that will be passed on the reader.
|
||||
## Interpretation of the values is left to the writer, but
|
||||
## A key/value table that will be passed to the reader.
|
||||
## Interpretation of the values is left to the reader, but
|
||||
## usually they will be used for configuration purposes.
|
||||
config: table[string] of string &default=table();
|
||||
config: table[string] of string &default=table();
|
||||
};
|
||||
|
||||
## EventFilter description type used for the `event` method.
|
||||
## An event input stream type used to send input data to a Bro event.
|
||||
type EventDescription: record {
|
||||
# Common definitions for tables and events
|
||||
|
||||
|
|
@ -116,19 +128,26 @@ export {
|
|||
|
||||
# Special definitions for events
|
||||
|
||||
## Record describing the fields to be retrieved from the source input.
|
||||
## Record type describing the fields to be retrieved from the input
|
||||
## source.
|
||||
fields: any;
|
||||
|
||||
## If this is false, the event receives each value in fields as a separate argument.
|
||||
## If this is set to true (default), the event receives all fields in a single record value.
|
||||
## If this is false, the event receives each value in *fields* as a
|
||||
## separate argument.
|
||||
## If this is set to true (default), the event receives all fields in
|
||||
## a single record value.
|
||||
want_record: bool &default=T;
|
||||
|
||||
## The event that is raised each time a new line is received from the reader.
|
||||
## The event will receive an Input::Event enum as the first element, and the fields as the following arguments.
|
||||
## The event that is raised each time a new line is received from the
|
||||
## reader. The event will receive an Input::EventDescription record
|
||||
## as the first argument, an Input::Event enum as the second
|
||||
## argument, and the fields (as specified in *fields*) as the following
|
||||
## arguments (this will either be a single record value containing
|
||||
## all fields, or each field value as a separate argument).
|
||||
ev: any;
|
||||
|
||||
## A key/value table that will be passed on the reader.
|
||||
## Interpretation of the values is left to the writer, but
|
||||
## A key/value table that will be passed to the reader.
|
||||
## Interpretation of the values is left to the reader, but
|
||||
## usually they will be used for configuration purposes.
|
||||
config: table[string] of string &default=table();
|
||||
};
|
||||
|
|
@ -155,28 +174,29 @@ export {
|
|||
## field will be the same value as the *source* field.
|
||||
name: string;
|
||||
|
||||
## A key/value table that will be passed on the reader.
|
||||
## Interpretation of the values is left to the writer, but
|
||||
## A key/value table that will be passed to the reader.
|
||||
## Interpretation of the values is left to the reader, but
|
||||
## usually they will be used for configuration purposes.
|
||||
config: table[string] of string &default=table();
|
||||
};
|
||||
|
||||
## Create a new table input from a given source.
|
||||
## Create a new table input stream from a given source.
|
||||
##
|
||||
## description: `TableDescription` record describing the source.
|
||||
##
|
||||
## Returns: true on success.
|
||||
global add_table: function(description: Input::TableDescription) : bool;
|
||||
|
||||
## Create a new event input from a given source.
|
||||
## Create a new event input stream from a given source.
|
||||
##
|
||||
## description: `EventDescription` record describing the source.
|
||||
##
|
||||
## Returns: true on success.
|
||||
global add_event: function(description: Input::EventDescription) : bool;
|
||||
|
||||
## Create a new file analysis input from a given source. Data read from
|
||||
## the source is automatically forwarded to the file analysis framework.
|
||||
## Create a new file analysis input stream from a given source. Data read
|
||||
## from the source is automatically forwarded to the file analysis
|
||||
## framework.
|
||||
##
|
||||
## description: A record describing the source.
|
||||
##
|
||||
|
|
@ -199,7 +219,11 @@ export {
|
|||
|
||||
## Event that is called when the end of a data source has been reached,
|
||||
## including after an update.
|
||||
global end_of_data: event(name: string, source:string);
|
||||
##
|
||||
## name: Name of the input stream.
|
||||
##
|
||||
## source: String that identifies the data source (such as the filename).
|
||||
global end_of_data: event(name: string, source: string);
|
||||
}
|
||||
|
||||
@load base/bif/input.bif
|
||||
|
|
|
|||
|
|
@ -11,7 +11,9 @@ export {
|
|||
##
|
||||
## name: name of the input stream.
|
||||
## source: source of the input stream.
|
||||
## exit_code: exit code of the program, or number of the signal that forced the program to exit.
|
||||
## signal_exit: false when program exited normally, true when program was forced to exit by a signal.
|
||||
## exit_code: exit code of the program, or number of the signal that forced
|
||||
## the program to exit.
|
||||
## signal_exit: false when program exited normally, true when program was
|
||||
## forced to exit by a signal.
|
||||
global process_finished: event(name: string, source:string, exit_code:count, signal_exit:bool);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -138,7 +138,7 @@ redef enum PcapFilterID += {
|
|||
|
||||
function test_filter(filter: string): bool
|
||||
{
|
||||
if ( ! precompile_pcap_filter(FilterTester, filter) )
|
||||
if ( ! Pcap::precompile_pcap_filter(FilterTester, filter) )
|
||||
{
|
||||
# The given filter was invalid
|
||||
# TODO: generate a notice.
|
||||
|
|
@ -273,7 +273,7 @@ function install(): bool
|
|||
return F;
|
||||
|
||||
local ts = current_time();
|
||||
if ( ! precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
|
||||
if ( ! Pcap::precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
|
||||
{
|
||||
NOTICE([$note=Compile_Failure,
|
||||
$msg=fmt("Compiling packet filter failed"),
|
||||
|
|
@ -303,7 +303,7 @@ function install(): bool
|
|||
}
|
||||
info$filter = current_filter;
|
||||
|
||||
if ( ! install_pcap_filter(DefaultPcapFilter) )
|
||||
if ( ! Pcap::install_pcap_filter(DefaultPcapFilter) )
|
||||
{
|
||||
# Installing the filter failed for some reason.
|
||||
info$success = F;
|
||||
|
|
|
|||
|
|
@ -349,7 +349,7 @@ type connection: record {
|
|||
## The outer VLAN, if applicable, for this connection.
|
||||
vlan: int &optional;
|
||||
|
||||
## The VLAN vlan, if applicable, for this connection.
|
||||
## The inner VLAN, if applicable, for this connection.
|
||||
inner_vlan: int &optional;
|
||||
};
|
||||
|
||||
|
|
@ -2509,7 +2509,7 @@ global dns_skip_all_addl = T &redef;
|
|||
|
||||
## If a DNS request includes more than this many queries, assume it's non-DNS
|
||||
## traffic and do not process it. Set to 0 to turn off this functionality.
|
||||
global dns_max_queries = 5;
|
||||
global dns_max_queries = 25 &redef;
|
||||
|
||||
## HTTP session statistics.
|
||||
##
|
||||
|
|
@ -3733,7 +3733,6 @@ export {
|
|||
## (includes GRE tunnels).
|
||||
const ip_tunnel_timeout = 24hrs &redef;
|
||||
} # end export
|
||||
module GLOBAL;
|
||||
|
||||
module Reporter;
|
||||
export {
|
||||
|
|
@ -3752,10 +3751,18 @@ export {
|
|||
## external harness and shouldn't output anything to the console.
|
||||
const errors_to_stderr = T &redef;
|
||||
}
|
||||
module GLOBAL;
|
||||
|
||||
## Number of bytes per packet to capture from live interfaces.
|
||||
const snaplen = 8192 &redef;
|
||||
module Pcap;
|
||||
export {
|
||||
## Number of bytes per packet to capture from live interfaces.
|
||||
const snaplen = 8192 &redef;
|
||||
|
||||
## Number of Mbytes to provide as buffer space when capturing from live
|
||||
## interfaces.
|
||||
const bufsize = 128 &redef;
|
||||
} # end export
|
||||
|
||||
module GLOBAL;
|
||||
|
||||
## Seed for hashes computed internally for probabilistic data structures. Using
|
||||
## the same value here will make the hashes compatible between independent Bro
|
||||
|
|
|
|||
|
|
@ -87,7 +87,8 @@ export {
|
|||
## f packet with FIN bit set
|
||||
## r packet with RST bit set
|
||||
## c packet with a bad checksum
|
||||
## i inconsistent packet (e.g. SYN+RST bits both set)
|
||||
## i inconsistent packet (e.g. FIN+RST bits set)
|
||||
## q multi-flag packet (SYN+FIN or SYN+RST bits set)
|
||||
## ====== ====================================================
|
||||
##
|
||||
## If the event comes from the originator, the letter is in
|
||||
|
|
|
|||
|
|
@ -270,7 +270,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
|
|||
{
|
||||
if ( /^[bB][aA][sS][iI][cC] / in value )
|
||||
{
|
||||
local userpass = decode_base64(sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
|
||||
local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
|
||||
local up = split_string(userpass, /:/);
|
||||
if ( |up| >= 2 )
|
||||
{
|
||||
|
|
|
|||
|
|
@ -60,9 +60,9 @@ export {
|
|||
## Contents of the Warning: header
|
||||
warning: string &log &optional;
|
||||
## Contents of the Content-Length: header from the client
|
||||
request_body_len: string &log &optional;
|
||||
request_body_len: count &log &optional;
|
||||
## Contents of the Content-Length: header from the server
|
||||
response_body_len: string &log &optional;
|
||||
response_body_len: count &log &optional;
|
||||
## Contents of the Content-Type: header from the server
|
||||
content_type: string &log &optional;
|
||||
};
|
||||
|
|
@ -127,17 +127,6 @@ function set_state(c: connection, is_request: bool)
|
|||
c$sip_state = s;
|
||||
}
|
||||
|
||||
# These deal with new requests and responses.
|
||||
if ( is_request && c$sip_state$current_request !in c$sip_state$pending )
|
||||
c$sip_state$pending[c$sip_state$current_request] = new_sip_session(c);
|
||||
if ( ! is_request && c$sip_state$current_response !in c$sip_state$pending )
|
||||
c$sip_state$pending[c$sip_state$current_response] = new_sip_session(c);
|
||||
|
||||
if ( is_request )
|
||||
c$sip = c$sip_state$pending[c$sip_state$current_request];
|
||||
else
|
||||
c$sip = c$sip_state$pending[c$sip_state$current_response];
|
||||
|
||||
if ( is_request )
|
||||
{
|
||||
if ( c$sip_state$current_request !in c$sip_state$pending )
|
||||
|
|
@ -152,7 +141,6 @@ function set_state(c: connection, is_request: bool)
|
|||
|
||||
c$sip = c$sip_state$pending[c$sip_state$current_response];
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
function flush_pending(c: connection)
|
||||
|
|
@ -163,7 +151,9 @@ function flush_pending(c: connection)
|
|||
for ( r in c$sip_state$pending )
|
||||
{
|
||||
# We don't use pending elements at index 0.
|
||||
if ( r == 0 ) next;
|
||||
if ( r == 0 )
|
||||
next;
|
||||
|
||||
Log::write(SIP::LOG, c$sip_state$pending[r]);
|
||||
}
|
||||
}
|
||||
|
|
@ -205,16 +195,39 @@ event sip_header(c: connection, is_request: bool, name: string, value: string) &
|
|||
if ( c$sip_state$current_request !in c$sip_state$pending )
|
||||
++c$sip_state$current_request;
|
||||
set_state(c, is_request);
|
||||
if ( name == "CALL-ID" ) c$sip$call_id = value;
|
||||
else if ( name == "CONTENT-LENGTH" || name == "L" ) c$sip$request_body_len = value;
|
||||
else if ( name == "CSEQ" ) c$sip$seq = value;
|
||||
else if ( name == "DATE" ) c$sip$date = value;
|
||||
else if ( name == "FROM" || name == "F" ) c$sip$request_from = split_string1(value, /;[ ]?tag=/)[0];
|
||||
else if ( name == "REPLY-TO" ) c$sip$reply_to = value;
|
||||
else if ( name == "SUBJECT" || name == "S" ) c$sip$subject = value;
|
||||
else if ( name == "TO" || name == "T" ) c$sip$request_to = value;
|
||||
else if ( name == "USER-AGENT" ) c$sip$user_agent = value;
|
||||
else if ( name == "VIA" || name == "V" ) c$sip$request_path[|c$sip$request_path|] = split_string1(value, /;[ ]?branch/)[0];
|
||||
switch ( name )
|
||||
{
|
||||
case "CALL-ID":
|
||||
c$sip$call_id = value;
|
||||
break;
|
||||
case "CONTENT-LENGTH", "L":
|
||||
c$sip$request_body_len = to_count(value);
|
||||
break;
|
||||
case "CSEQ":
|
||||
c$sip$seq = value;
|
||||
break;
|
||||
case "DATE":
|
||||
c$sip$date = value;
|
||||
break;
|
||||
case "FROM", "F":
|
||||
c$sip$request_from = split_string1(value, /;[ ]?tag=/)[0];
|
||||
break;
|
||||
case "REPLY-TO":
|
||||
c$sip$reply_to = value;
|
||||
break;
|
||||
case "SUBJECT", "S":
|
||||
c$sip$subject = value;
|
||||
break;
|
||||
case "TO", "T":
|
||||
c$sip$request_to = value;
|
||||
break;
|
||||
case "USER-AGENT":
|
||||
c$sip$user_agent = value;
|
||||
break;
|
||||
case "VIA", "V":
|
||||
c$sip$request_path[|c$sip$request_path|] = split_string1(value, /;[ ]?branch/)[0];
|
||||
break;
|
||||
}
|
||||
|
||||
c$sip_state$pending[c$sip_state$current_request] = c$sip;
|
||||
}
|
||||
|
|
@ -222,13 +235,29 @@ event sip_header(c: connection, is_request: bool, name: string, value: string) &
|
|||
{
|
||||
if ( c$sip_state$current_response !in c$sip_state$pending )
|
||||
++c$sip_state$current_response;
|
||||
|
||||
set_state(c, is_request);
|
||||
if ( name == "CONTENT-LENGTH" || name == "L" ) c$sip$response_body_len = value;
|
||||
else if ( name == "CONTENT-TYPE" || name == "C" ) c$sip$content_type = value;
|
||||
else if ( name == "WARNING" ) c$sip$warning = value;
|
||||
else if ( name == "FROM" || name == "F" ) c$sip$response_from = split_string1(value, /;[ ]?tag=/)[0];
|
||||
else if ( name == "TO" || name == "T" ) c$sip$response_to = value;
|
||||
else if ( name == "VIA" || name == "V" ) c$sip$response_path[|c$sip$response_path|] = split_string1(value, /;[ ]?branch/)[0];
|
||||
switch ( name )
|
||||
{
|
||||
case "CONTENT-LENGTH", "L":
|
||||
c$sip$response_body_len = to_count(value);
|
||||
break;
|
||||
case "CONTENT-TYPE", "C":
|
||||
c$sip$content_type = value;
|
||||
break;
|
||||
case "WARNING":
|
||||
c$sip$warning = value;
|
||||
break;
|
||||
case "FROM", "F":
|
||||
c$sip$response_from = split_string1(value, /;[ ]?tag=/)[0];
|
||||
break;
|
||||
case "TO", "T":
|
||||
c$sip$response_to = value;
|
||||
break;
|
||||
case "VIA", "V":
|
||||
c$sip$response_path[|c$sip$response_path|] = split_string1(value, /;[ ]?branch/)[0];
|
||||
break;
|
||||
}
|
||||
|
||||
c$sip_state$pending[c$sip_state$current_response] = c$sip;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
signature dpd_ssl_server {
|
||||
ip-proto == tcp
|
||||
# Server hello.
|
||||
payload /^(\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/
|
||||
payload /^((\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/
|
||||
requires-reverse-signature dpd_ssl_client
|
||||
enable "ssl"
|
||||
tcp-state responder
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue