Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Restore behavior of Software::register event

Browse source 
Use an intermediary event to ensure that software versions are parsed
before calling Software::register.
This commit is contained in:
Justin Azoff 2021-09-20 14:38:47 -04:00
parent 3bf8c8ceb6
commit ef5fb790ef
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/base/frameworks/software/main.zeek
View file

@ -476,9 +476,11 @@ function software_fmt(i: Info): string
return fmt("%s %s", i$name, software_fmt_version(i$version));
}
event Software::register(info: Info)
# Parse unparsed_version if needed before raising register event
# This is used to maintain the behavior of the exported Software::register
# event that expects a pre-parsed 'name' field.
event Software::new(info: Info)
{
if ( ! info?$version )
{
local sw = parse_with_cache(info$unparsed_version);
@ -487,6 +489,12 @@ event Software::register(info: Info)
info$version = sw$version;
}
event Software::register(info);
}
event Software::register(info: Info)
{
local ts: SoftwareSet;
if ( info$host in tracked )
@ -536,9 +544,9 @@ function found(id: conn_id, info: Info): bool
}
@if ( Cluster::is_enabled() )
Cluster::publish_hrw(Cluster::proxy_pool, info$host, Software::register, info);
Cluster::publish_hrw(Cluster::proxy_pool, info$host, Software::new, info);
@else
event Software::register(info);
event Software::new(info);
@endif
return T;