mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 05:58:20 +00:00

It can be used to discover if a DNS zone can be considered local with the is_local_name function.
21 lines
769 B
Text
21 lines
769 B
Text
##! Functions for creating patterns.
|
|
|
|
## This function only works at or before init time. Given a pattern as a string
|
|
## with two tildes (~~) contained in it, it will return a pattern with the
|
|
## set[string] elements OR'd together where the double-tilde was given.
|
|
## If a literal backslash is include in 'pat', it needs to be given as a double
|
|
## backslash due to Bro's string parsing reducing it to a single backslash
|
|
## upon rendering.
|
|
function build_regex(ss: set[string], pat: string): pattern
|
|
{
|
|
local i: count = 0;
|
|
local return_pat = "";
|
|
for ( s in ss )
|
|
{
|
|
local tmp_pattern = convert_for_pattern(s);
|
|
return_pat = ( i == 0 ) ?
|
|
tmp_pattern : cat(tmp_pattern, "|", return_pat);
|
|
++i;
|
|
}
|
|
return string_to_pattern(sub(pat, /~~/, return_pat), F);
|
|
}
|