Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix (non)suppression of proxy-bound events in known-*.bro scripts

Browse source 
When not using data stores, these scripts were intended to suppress
sending duplicate events to proxies by looking up the key in the local
cache.
This commit is contained in:
Jon Siwek 2018-08-06 17:04:42 -05:00
parent 29359ffff2
commit e6042940dc
3 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/policy/protocols/conn/known-hosts.bro
View file

@ -138,6 +138,9 @@ event Known::host_found(info: HostsInfo)
if ( use_host_store )
return;
if ( info$host in Known::hosts )
return;
Cluster::publish_hrw(Cluster::proxy_pool, info$host, known_host_add, info);
event known_host_add(info);
}

3
scripts/policy/protocols/conn/known-services.bro
View file

@ -159,6 +159,9 @@ event service_info_commit(info: ServicesInfo)
if ( Known::use_service_store )
return;
if ( [info$host, info$port_num] in Known::services )
return;
local key = cat(info$host, info$port_num);
Cluster::publish_hrw(Cluster::proxy_pool, key, known_service_add, info);
event known_service_add(info);

5
scripts/policy/protocols/ssl/known-certs.bro
View file

@ -127,6 +127,9 @@ event Known::cert_found(info: CertsInfo, hash: string)
if ( Known::use_cert_store )
return;
if ( [info$host, hash] in Known::certs )
return;
local key = cat(info$host, hash);
Cluster::publish_hrw(Cluster::proxy_pool, key, known_cert_add, info, hash);
event known_cert_add(info, hash);
@ -140,6 +143,7 @@ event Cluster::node_up(name: string, id: string)
if ( Cluster::local_node_type() != Cluster::WORKER )
return;
# Drop local suppression cache on workers to force HRW key repartitioning.
Known::certs = table();
}
@ -151,6 +155,7 @@ event Cluster::node_down(name: string, id: string)
if ( Cluster::local_node_type() != Cluster::WORKER )
return;
# Drop local suppression cache on workers to force HRW key repartitioning.
Known::certs = table();
}