mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
1bd658da8f
This adds a "policy" hook into the logging framework's streams and
filters to replace the existing log filter predicates. The hook
signature is as follows:
hook(rec: any, id: Log::ID, filter: Log::Filter);
The logging manager invokes hooks on each log record. Hooks can veto
log records via a break, and modify them if necessary. Log filters
inherit the stream-level hook, but can override or remove the hook as
needed.
The distribution's existing log streams now come with pre-defined
hooks that users can add handlers to. Their name is standardized as
"log_policy" by convention, with additional suffixes when a module
provides multiple streams. The following adds a handler to the Conn
module's default log policy hook:
hook Conn::log_policy(rec: Conn::Info, id: Log::ID, filter: Log::Filter)
{
if ( some_veto_reason(rec) )
break;
}
By default, this handler will get invoked for any log filter
associated with the Conn::LOG stream.
The existing predicates are deprecated for removal in 4.1 but continue
to work.
72 lines
1.9 KiB
Text
72 lines
1.9 KiB
Text
##! Base Modbus analysis script.
|
|
|
|
module Modbus;
|
|
|
|
@load ./consts
|
|
|
|
export {
|
|
redef enum Log::ID += { LOG };
|
|
|
|
global log_policy: Log::PolicyHook;
|
|
|
|
type Info: record {
|
|
## Time of the request.
|
|
ts: time &log;
|
|
## Unique identifier for the connection.
|
|
uid: string &log;
|
|
## Identifier for the connection.
|
|
id: conn_id &log;
|
|
## The name of the function message that was sent.
|
|
func: string &log &optional;
|
|
## The exception if the response was a failure.
|
|
exception: string &log &optional;
|
|
};
|
|
|
|
## Event that can be handled to access the Modbus record as it is sent
|
|
## on to the logging framework.
|
|
global log_modbus: event(rec: Info);
|
|
}
|
|
|
|
redef record connection += {
|
|
modbus: Info &optional;
|
|
};
|
|
|
|
const ports = { 502/tcp };
|
|
redef likely_server_ports += { ports };
|
|
|
|
event zeek_init() &priority=5
|
|
{
|
|
Log::create_stream(Modbus::LOG, [$columns=Info, $ev=log_modbus, $path="modbus", $policy=log_policy]);
|
|
Analyzer::register_for_ports(Analyzer::ANALYZER_MODBUS, ports);
|
|
}
|
|
|
|
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &priority=5
|
|
{
|
|
if ( ! c?$modbus )
|
|
{
|
|
c$modbus = [$ts=network_time(), $uid=c$uid, $id=c$id];
|
|
}
|
|
|
|
c$modbus$ts = network_time();
|
|
c$modbus$func = function_codes[headers$function_code];
|
|
}
|
|
|
|
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &priority=-5
|
|
{
|
|
# Only log upon replies.
|
|
# Also, don't log now if this is an exception (log in the exception event handler)
|
|
if ( ! is_orig && ( headers$function_code <= 0x81 || headers$function_code >= 0x98 ) )
|
|
Log::write(LOG, c$modbus);
|
|
}
|
|
|
|
event modbus_exception(c: connection, headers: ModbusHeaders, code: count) &priority=5
|
|
{
|
|
c$modbus$exception = exception_codes[code];
|
|
}
|
|
|
|
event modbus_exception(c: connection, headers: ModbusHeaders, code: count) &priority=-5
|
|
{
|
|
Log::write(LOG, c$modbus);
|
|
delete c$modbus$exception;
|
|
}
|
|
|