mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
19c1816ebb
There's now a new directory "src/protocols/", and the plan is for each
protocol analyzer to eventually have its own subdirectory in there
that contains everything it defines (C++/pac/bif). The infrastructure
to make that happen is in place, and two analyzers have been
converted to the new model, HTTP and SSL; there's no further
HTTP/SSL-specific code anywhere else in the core anymore (I believe :-)
Further changes:
- -N lists available plugins, -NN lists more details on what these
plugins provide (analyzers, bif elements). (The latter does not
work for analyzers that haven't been converted yet).
- *.bif.bro files now go into scripts/base/bif/; and
scripts/base/bif/plugins/ for bif files provided by plugins.
- I've factored out the bifcl/binpac CMake magic from
src/CMakeLists.txt to cmake/{BifCl,Binpac}
- There's a new cmake/BroPlugin that contains magic to allow
plugins to have a simple CMakeLists.txt. The hope is that
eventually the same CMakeLists.txt can be used for compiling a
plugin either statically or dynamically.
- bifcl has a new option -c that changes the code it generates so
that it can be used with a plugin.
TODOs:
- "make install" is probably broken.
- Broxygen is probably broken for plugin-defined events.
- event groups are broken (do we want to keep them?)
127 lines
2.8 KiB
Text
127 lines
2.8 KiB
Text
|
|
module Analyzer;
|
|
|
|
# Analyzer::Tag is defined in types.bif, and automatically extended by plugins
|
|
# as they are loaded.
|
|
|
|
export {
|
|
## XXX.
|
|
global enable_analyzer: function(tag: Analyzer::Tag) : bool;
|
|
|
|
## XXX.
|
|
global disable_analyzer: function(tag: Analyzer::Tag) : bool;
|
|
|
|
## XXX.
|
|
global register_for_ports: function(tag: Analyzer::Tag, ports: set[port]) : bool;
|
|
|
|
## XXX.
|
|
global register_for_port: function(tag: Analyzer::Tag, p: port) : bool;
|
|
|
|
## XXX.
|
|
global registered_ports: function(tag: Analyzer::Tag) : set[port];
|
|
|
|
## XXX
|
|
global all_registered_ports: function() : table[Analyzer::Tag] of set[port];
|
|
|
|
## Translate an analyzer type to an ASCII string.
|
|
##
|
|
## atype: The analyzer tag.
|
|
##
|
|
## Returns: The analyzer *aid* as string.
|
|
global name: function(atype: Analyzer::Tag) : string;
|
|
|
|
## Schedules an analyzer for a future connection from a given IP address and
|
|
## port. The function ignores the scheduling request if the connection did
|
|
## not occur within the specified time interval.
|
|
##
|
|
## orig: The IP address originating a connection in the future.
|
|
##
|
|
## resp: The IP address responding to a connection from *orig*.
|
|
##
|
|
## resp_p: The destination port at *resp*.
|
|
##
|
|
## analyzer: The analyzer ID.
|
|
##
|
|
## tout: The timeout interval after which to ignore the scheduling request.
|
|
##
|
|
## Returns: True if succesful.
|
|
global expect_connection: function(orig: addr, resp: addr, resp_p: port,
|
|
analyzer: Analyzer::Tag, tout: interval) : bool;
|
|
|
|
## Analyzers to disable at startup.
|
|
global disabled_analyzers: set[Analyzer::Tag] = {
|
|
ANALYZER_INTERCONN,
|
|
ANALYZER_STEPPINGSTONE,
|
|
ANALYZER_BACKDOOR,
|
|
ANALYZER_TCPSTATS,
|
|
}
|
|
|
|
&redef;
|
|
}
|
|
|
|
@load base/bif/analyzer.bif
|
|
|
|
global ports: table[Analyzer::Tag] of set[port];
|
|
|
|
event bro_init()
|
|
{
|
|
for ( a in disabled_analyzers )
|
|
disable_analyzer(a);
|
|
}
|
|
|
|
function enable_analyzer(tag: Analyzer::Tag) : bool
|
|
{
|
|
return __enable_analyzer(tag);
|
|
}
|
|
|
|
function disable_analyzer(tag: Analyzer::Tag) : bool
|
|
{
|
|
return __disable_analyzer(tag);
|
|
}
|
|
|
|
function register_for_ports(tag: Analyzer::Tag, ports: set[port]) : bool
|
|
{
|
|
local rc = T;
|
|
|
|
for ( p in ports )
|
|
{
|
|
if ( ! register_for_port(tag, p) )
|
|
rc = F;
|
|
}
|
|
|
|
return rc;
|
|
}
|
|
|
|
function register_for_port(tag: Analyzer::Tag, p: port) : bool
|
|
{
|
|
if ( ! __register_for_port(tag, p) )
|
|
return F;
|
|
|
|
if ( tag !in ports )
|
|
ports[tag] = set();
|
|
|
|
add ports[tag][p];
|
|
return T;
|
|
}
|
|
|
|
function registered_ports(tag: Analyzer::Tag) : set[port]
|
|
{
|
|
return tag in ports ? ports[tag] : set();
|
|
}
|
|
|
|
function all_registered_ports(): table[Analyzer::Tag] of set[port]
|
|
{
|
|
return ports;
|
|
}
|
|
|
|
function name(atype: Analyzer::Tag) : string
|
|
{
|
|
return __name(atype);
|
|
}
|
|
|
|
function expect_connection(orig: addr, resp: addr, resp_p: port,
|
|
analyzer: Analyzer::Tag, tout: interval) : bool
|
|
{
|
|
return __expect_connection(orig, resp, resp_p, analyzer, tout);
|
|
}
|
|
|