Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Move netbios_ssn_session_timeout to a script-level constant

Browse source
This commit is contained in:
Tim Wojtulewicz 2025-06-06 14:06:07 -07:00
parent 61f93f9eb6
commit ed51738668
3 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/init-bare.zeek
View file

@ -579,6 +579,10 @@ const io_poll_interval_live = 10 &redef;
## while testing, but should be used sparingly. ## while testing, but should be used sparingly.
const running_under_test: bool = F &redef; const running_under_test: bool = F &redef;
## The amount of time before a connection created by the netbios analyzer times
## out and is removed.
const netbios_ssn_session_timeout: interval = 15 sec &redef;
module EventMetadata; module EventMetadata;
export { export {

12
src/analyzer/protocol/netbios/NetbiosSSN.cc
View file

@ -10,8 +10,6 @@
#include "zeek/analyzer/protocol/netbios/events.bif.h" #include "zeek/analyzer/protocol/netbios/events.bif.h"
#include "zeek/session/Manager.h" #include "zeek/session/Manager.h"
static constexpr double netbios_ssn_session_timeout = 15.0;
static constexpr void MAKE_INT16(uint16_t& dest, const u_char*& src) { static constexpr void MAKE_INT16(uint16_t& dest, const u_char*& src) {
dest = *src; dest = *src;
dest <= 8; dest <= 8;
@ -397,8 +395,9 @@ NetbiosSSN_Analyzer::NetbiosSSN_Analyzer(Connection* conn)
AddSupportAnalyzer(resp_netbios); AddSupportAnalyzer(resp_netbios);
} }
else { else {
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, run_state::network_time + netbios_ssn_session_timeout, ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer,
true, zeek::detail::TIMER_NB_EXPIRE); run_state::network_time + BifConst::netbios_ssn_session_timeout, true,
zeek::detail::TIMER_NB_EXPIRE);
} }
} }
@ -446,12 +445,13 @@ void NetbiosSSN_Analyzer::ExpireTimer(double t) {
// The - 1.0 in the following is to allow 1 second for the // The - 1.0 in the following is to allow 1 second for the
// common case of a single request followed by a single reply, // common case of a single request followed by a single reply,
// so we don't needlessly set the timer twice in that case. // so we don't needlessly set the timer twice in that case.
if ( run_state::terminating || run_state::network_time - Conn()->LastTime() >= netbios_ssn_session_timeout - 1.0 ) { if ( run_state::terminating ||
run_state::network_time - Conn()->LastTime() >= BifConst::netbios_ssn_session_timeout - 1.0 ) {
Event(connection_timeout); Event(connection_timeout);
session_mgr->Remove(Conn()); session_mgr->Remove(Conn());
} }
else else
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, t + netbios_ssn_session_timeout, true, ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, t + BifConst::netbios_ssn_session_timeout, true,
zeek::detail::TIMER_NB_EXPIRE); zeek::detail::TIMER_NB_EXPIRE);
} }

1
src/const.bif
View file

@ -12,6 +12,7 @@ const report_gaps_for_partial: bool;
const exit_only_after_terminate: bool; const exit_only_after_terminate: bool;
const digest_salt: string; const digest_salt: string;
const max_analyzer_violations: count; const max_analyzer_violations: count;
const netbios_ssn_session_timeout: interval;
const io_poll_interval_default: count; const io_poll_interval_default: count;
const io_poll_interval_live: count; const io_poll_interval_live: count;