Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Establish plugin infrastructure for connection tuple "builders".

Browse source 
Builders are intermediaries that encapsulate the details of how to instantiate
connection tuples & keys. By virtualizing those data structures, builder
implementations can adapt Zeek's notion of connection tuples.
This commit is contained in:
Christian Kreibich 2025-04-09 18:49:25 -07:00
parent fa6c32327d
commit df386bb9b2
14 changed files with 263 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/init-bare.zeek
View file

@ -579,6 +579,19 @@ const io_poll_interval_live = 10 &redef;
## while testing, but should be used sparingly.
const running_under_test: bool = F &redef;
module ConnTuple;
export {
## The connection tuple builder to use for Zeek's internal flow
## tracking. This is a ``ConnTuple::Tag`` plugin component enum value,
## and the default is 5-tuple-tracking based on IP/port endpoint pairs,
## plus transport protocol. Plugins can provide their own
## implementation. You'll usually not adjust this value in isolation,
## but with a corresponding redef of the :zeek:type:`conn_id` record to
## represent additional tuple members.
const builder = ConnTuple::CONNTUPLE_FIVETUPLE &redef;
}
module FTP;
export {