Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add spicy runtime-support current_analyzer_id(), use it to set id in events

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-12-18 15:32:10 -07:00
parent 991bc9644d
commit fd4f25965d
5 changed files with 42 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/spicy/runtime-support.cc
View file

@ -206,7 +206,7 @@ void rt::raise_event(const EventHandlerPtr& handler, const hilti::rt::Vector<Val
throw InvalidValue("null value encountered after conversion");
}
event_mgr.Enqueue(handler, std::move(vl));
event_mgr.Enqueue(handler, std::move(vl), util::detail::SOURCE_LOCAL, rt::current_analyzer_id());
}
TypePtr rt::event_arg_type(const EventHandlerPtr& handler, const hilti::rt::integer::safe<uint64_t>& idx) {
@ -221,6 +221,24 @@ TypePtr rt::event_arg_type(const EventHandlerPtr& handler, const hilti::rt::inte
return zeek_args[idx];
}
zeek::analyzer::ID rt::current_analyzer_id() {
auto _ = hilti::rt::profiler::start("zeek/rt/current_analyzer_id");
if ( auto cookie = static_cast<Cookie*>(hilti::rt::context::cookie()) ) {
if ( auto x = cookie->protocol ) {
return x->analyzer->GetID();
}
else if ( auto x = cookie->file ) {
return 0;
}
else if ( auto x = cookie->packet ) {
return 0;
}
}
throw ValueUnavailable("analyzer not available");
}
ValPtr& rt::current_conn() {
auto _ = hilti::rt::profiler::start("zeek/rt/current_conn");

8
src/spicy/runtime-support.h
View file

@ -209,6 +209,14 @@ void raise_event(const EventHandlerPtr& handler, const hilti::rt::Vector<ValPtr>
*/
TypePtr event_arg_type(const EventHandlerPtr& handler, const hilti::rt::integer::safe<uint64_t>& idx);
/**
* Retrieves the analyzer ID for the currently processed Zeek connection.
* Assumes that the HILTI context's cookie value has been set accordingly.
*
* @return Pointer to an analyzer instance
*/
zeek::analyzer::ID current_analyzer_id();
/**
* Retrieves the connection ID for the currently processed Zeek connection.
* Assumes that the HILTI context's cookie value has been set accordingly.

3
testing/btest/Baseline/spicy.analyzer-id/out Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
CHhAvVGS1DHFjwGM9, PostgreSQL::ssl_request, 3
CHhAvVGS1DHFjwGM9, ssl_client_hello, 5

1
testing/btest/Baseline/spicy.profiling/prof.log
View file

@ -16,6 +16,7 @@ spicy/unit/SSH::Banner::magic 2
spicy/unit/SSH::Banner::software 2
spicy/unit/SSH::Banner::version 2
zeek/event/ssh::banner 2
zeek/rt/current_analyzer_id 2
zeek/rt/current_conn 2
zeek/rt/current_is_orig 2
zeek/rt/event_arg_type 4

11
testing/btest/spicy/analyzer-id.zeek Normal file
View file

@ -0,0 +1,11 @@
#@TEST-DOC: Test that analyzer ID set for spicy protocol analyzers
#@TEST-EXEC: zeek -r $TRACES/postgresql/psql-aws-ssl-preferred.pcap %INPUT > out
#@TEST-EXEC: btest-diff out
event PostgreSQL::ssl_request(c: connection) {
print c$uid, "PostgreSQL::ssl_request", current_analyzer();
}
event ssl_client_hello(c: connection, version: count, record_version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec, comp_methods: index_vec) {
print c$uid, "ssl_client_hello", current_analyzer();
}