mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
597a4d6704
- policy/ renamed to scripts/ - By default BROPATH now contains: - scripts/ - scripts/policy - scripts/site - *Nearly* all tests pass. - All of scripts/base/ is loaded by main.cc - Can be disabled by setting $BRO_NO_BASE_SCRIPTS - Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script). - The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building. - The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead. - All "detection" activity happens through scripts in scripts/policy/. - Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1) - This is so the communications framework can be loaded as part of the base without causing trouble when it's not needed. - This will be removed once a resolution to ticket #540 is reached.
41 lines
1.3 KiB
Text
41 lines
1.3 KiB
Text
##! Adjust the inactivity timeouts for interactive services which could
|
|
##! very possibly have long delays between packets.
|
|
|
|
module Conn;
|
|
|
|
export {
|
|
## Define inactivty timeouts by the service detected being used over
|
|
## the connection.
|
|
const analyzer_inactivity_timeouts: table[AnalyzerTag] of interval = {
|
|
# For interactive services, allow longer periods of inactivity.
|
|
[[ANALYZER_SSH, ANALYZER_FTP]] = 1 hrs,
|
|
} &redef;
|
|
|
|
## Define inactivity timeouts based on common protocol ports.
|
|
const port_inactivity_timeouts: table[port] of interval = {
|
|
[[21/tcp, 22/tcp, 23/tcp, 513/tcp]] = 1 hrs,
|
|
} &redef;
|
|
|
|
}
|
|
|
|
event protocol_confirmation(c: connection, atype: count, aid: count)
|
|
{
|
|
if ( atype in analyzer_inactivity_timeouts )
|
|
set_inactivity_timeout(c$id, analyzer_inactivity_timeouts[atype]);
|
|
}
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
local service_port = c$id$resp_p;
|
|
if ( c$orig$state == TCP_INACTIVE )
|
|
{
|
|
# We're seeing a half-established connection. Use the
|
|
# service of the originator if it's well-known and the
|
|
# responder isn't.
|
|
if ( service_port !in likely_server_ports && c$id$orig_p in likely_server_ports )
|
|
service_port = c$id$orig_p;
|
|
}
|
|
|
|
if ( service_port in port_inactivity_timeouts )
|
|
set_inactivity_timeout(c$id, port_inactivity_timeouts[service_port]);
|
|
}
|