Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Restore behavior of Software::register event

Browse source 
Use an intermediary event to ensure that software versions are parsed
before calling Software::register.
This commit is contained in:
Justin Azoff 2021-09-20 14:38:47 -04:00
parent 3bf8c8ceb6
commit ef5fb790ef
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/base/frameworks/software/main.zeek
View file

@ -476,9 +476,11 @@ function software_fmt(i: Info): string
return fmt("%s %s", i$name, software_fmt_version(i$version)); return fmt("%s %s", i$name, software_fmt_version(i$version));
} }
event Software::register(info: Info) # Parse unparsed_version if needed before raising register event
# This is used to maintain the behavior of the exported Software::register
# event that expects a pre-parsed 'name' field.
event Software::new(info: Info)
{ {
if ( ! info?$version ) if ( ! info?$version )
{ {
local sw = parse_with_cache(info$unparsed_version); local sw = parse_with_cache(info$unparsed_version);
@ -487,6 +489,12 @@ event Software::register(info: Info)
info$version = sw$version; info$version = sw$version;
} }
event Software::register(info);
}
event Software::register(info: Info)
{
local ts: SoftwareSet; local ts: SoftwareSet;
if ( info$host in tracked ) if ( info$host in tracked )
@ -536,9 +544,9 @@ function found(id: conn_id, info: Info): bool
} }
@if ( Cluster::is_enabled() ) @if ( Cluster::is_enabled() )
Cluster::publish_hrw(Cluster::proxy_pool, info$host, Software::register, info); Cluster::publish_hrw(Cluster::proxy_pool, info$host, Software::new, info);
@else @else
event Software::register(info); event Software::new(info);
@endif @endif
return T; return T;