zeek/scripts/policy/frameworks/notice/community-id.zeek
Arne Welzel e82a7455d7 policy/community-id: Do not use new_connection()
Issue #3028 tracks how a flipped connections reset a connection's value
including any state set during new_connection(). For the time being,
update community-id functionality back to the original connection_state_remove()
approach to avoid missing community_ids on flipped connections.
2023-05-10 17:48:33 +02:00

28 lines
675 B
Text

# Source this script in addition to protocols/conn/community-id
# to add Community ID to notices.
# Only support loading this if the main script is also loaded.
@load base/protocols/conn
@load base/frameworks/notice
@ifdef ( CommunityID::seed )
module CommunityID::Notice;
export {
# Turn notice support on/off at runtime. When disabled,
# this still leaves the `community_id` string in the notice
# log, just unset.
option enabled: bool = T;
redef record Notice::Info += {
community_id: string &optional &log;
};
}
hook Notice::notice(n: Notice::Info)
{
if ( CommunityID::Notice::enabled && n?$conn )
n$community_id = community_id_v1(n$conn$id);
}
@endif