zeek/policy/utils/pattern.bro
Seth Hall 31c7e56a14 New var and func: local_zones: set[string] and is_local_name(string): bool
It can be used to discover if a DNS zone can be considered local
with the is_local_name function.
2011-04-12 13:11:06 -04:00

21 lines
769 B
Text

##! Functions for creating patterns.
## This function only works at or before init time. Given a pattern as a string
## with two tildes (~~) contained in it, it will return a pattern with the
## set[string] elements OR'd together where the double-tilde was given.
## If a literal backslash is include in 'pat', it needs to be given as a double
## backslash due to Bro's string parsing reducing it to a single backslash
## upon rendering.
function build_regex(ss: set[string], pat: string): pattern
{
local i: count = 0;
local return_pat = "";
for ( s in ss )
{
local tmp_pattern = convert_for_pattern(s);
return_pat = ( i == 0 ) ?
tmp_pattern : cat(tmp_pattern, "|", return_pat);
++i;
}
return string_to_pattern(sub(pat, /~~/, return_pat), F);
}