Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Convert some redef-able constants to runtime options

Browse source
This commit is contained in:
Daniel Thayer 2018-08-15 10:17:14 -05:00
parent 0e6913fba0
commit dc0904a7f3
20 changed files with 37 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/dhcp/main.bro
View file

@ -77,7 +77,7 @@ export {
## The maximum amount of time that a transation ID will be watched
## for to try and tie messages together into a single DHCP
## transaction narrative.
const DHCP::max_txid_watch_time = 30secs &redef;
option DHCP::max_txid_watch_time = 30secs;
## This event is used internally to distribute data around clusters
## since DHCP doesn't follow the normal "connection" model used by

6
scripts/base/protocols/ftp/main.bro
View file

@ -17,13 +17,13 @@ export {
redef enum Log::ID += { LOG };
## List of commands that should have their command/response pairs logged.
const logged_commands = {
option logged_commands = {
"APPE", "DELE", "RETR", "STOR", "STOU", "ACCT", "PORT", "PASV", "EPRT",
"EPSV"
} &redef;
};
## User IDs that can be considered "anonymous".
const guest_ids = { "anonymous", "ftp", "ftpuser", "guest" } &redef;
option guest_ids = { "anonymous", "ftp", "ftpuser", "guest" };
## This record is to hold a parsed FTP reply code. For example, for the
## 201 status code, the digits would be parsed as: x->2, y->0, z->1.

4
scripts/base/protocols/http/main.bro
View file

@ -109,7 +109,7 @@ export {
## A list of HTTP methods. Other methods will generate a weird. Note
## that the HTTP analyzer will only accept methods consisting solely
## of letters ``[A-Za-z]``.
const http_methods: set[string] = {
option http_methods: set[string] = {
"GET", "POST", "HEAD", "OPTIONS",
"PUT", "DELETE", "TRACE", "CONNECT",
# HTTP methods for distributed authoring:
@ -117,7 +117,7 @@ export {
"COPY", "MOVE", "LOCK", "UNLOCK",
"POLL", "REPORT", "SUBSCRIBE", "BMOVE",
"SEARCH"
} &redef;
};
## Event that can be handled to access the HTTP record as it is sent on
## to the logging framework.

4
scripts/base/protocols/krb/main.bro
View file

@ -48,7 +48,7 @@ export {
};
## The server response error texts which are *not* logged.
const ignored_errors: set[string] = {
option ignored_errors: set[string] = {
# This will significantly increase the noisiness of the log.
# However, one attack is to iterate over principals, looking
# for ones that don't require preauth, and then performn
@ -58,7 +58,7 @@ export {
# This is a more specific version of NEEDED_PREAUTH that's used
# by Windows AD Kerberos.
"Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ",
} &redef;
};
## Event that can be handled to access the KRB record as it is sent on
## to the logging framework.

4
scripts/base/protocols/sip/main.bro
View file

@ -80,9 +80,9 @@ export {
## A list of SIP methods. Other methods will generate a weird. Note
## that the SIP analyzer will only accept methods consisting solely
## of letters ``[A-Za-z]``.
const sip_methods: set[string] = {
option sip_methods: set[string] = {
"REGISTER", "INVITE", "ACK", "CANCEL", "BYE", "OPTIONS", "NOTIFY", "SUBSCRIBE"
} &redef;
};
## Event that can be handled to access the SIP record as it is sent on
## to the logging framework.