mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
f0b9c59adb
zeek.on('zeek_init', () => {
console.log('Hello, Zeek!');
});
For interaction with external systems and HTTP APIs, JavaScript and the
Node.js ecosystem beat Zeek script. Make it more easily accessible by
including ZeekJS with Zeek directly.
When a recent enough libnode version is found on the build system, ZeekJS is
added as a builtin plugin. This behavior can be disabled via
``--disable-javascript``. Linux distributions providing such a package are
Ubuntu (22.10) and Debian (testing/bookworm) as libnode-dev.
Fedora provides it as nodejs-devel.
This plugin takes over loading of .js or .cjs files. When no such files
are provided to Zeek, Node and the V8 engine are not initialized and
should not get into the way.
This should be considered experimental.
39 lines
1.3 KiB
JavaScript
39 lines
1.3 KiB
JavaScript
/*
|
|
* @TEST-DOC: Demo suspend and continue processing from JavaScript
|
|
* @TEST-REQUIRES: $SCRIPTS/have-javascript
|
|
* @TEST-EXEC: zeek -b -Cr $TRACES/http/get.trace base/protocols/http %INPUT > out
|
|
* @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
|
|
*/
|
|
zeek.on('zeek_init', () => {
|
|
const nt = zeek.invoke('network_time');
|
|
console.log(`${nt} suspend_processing`);
|
|
zeek.invoke('suspend_processing');
|
|
const suspended_at = Date.now();
|
|
|
|
// Schedule a JavaScript timer (running based on wallclock)
|
|
// to continue execution in 333 msec.
|
|
setTimeout(() => {
|
|
const nt = zeek.invoke('network_time');
|
|
const continued_at = Date.now();
|
|
const delayed_ms = continued_at - suspended_at;
|
|
const delayed_enough = delayed_ms > 300;
|
|
|
|
console.log(`${nt} continue_processing (delayed_enough=${delayed_enough})`);
|
|
zeek.invoke('continue_processing');
|
|
}, 333);
|
|
});
|
|
|
|
zeek.on('http_request', (c, method, orig_URI, escaped_URI, version) => {
|
|
const nt = zeek.invoke('network_time');
|
|
console.log(`${nt} http_request ${c.uid} ${method} ${orig_URI} ${version}`);
|
|
});
|
|
|
|
zeek.on('Pcap::file_done', (path) => {
|
|
const nt = zeek.invoke('network_time');
|
|
console.log(`${nt} Pcap::file_done ${path}`);
|
|
});
|
|
|
|
zeek.on('zeek_done', () => {
|
|
const nt = zeek.invoke('network_time');
|
|
console.log(`${nt} zeek_done`);
|
|
});
|