59 lines
1.5 KiB
Plaintext
59 lines
1.5 KiB
Plaintext
# @TEST-DOC: Example using lookup_addr()
|
|
|
|
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff .stdout
|
|
# @TEST-EXEC: btest-diff .stderr
|
|
# @TEST-EXEC: zeek-cut -m ts uid id.orig_h orig_name id.resp_h resp_name < conn.log > conn.cut
|
|
# @TEST-EXEC: btest-diff conn.cut
|
|
|
|
|
|
# Enrich conn.log with lookup_addr() result
|
|
@load base/protocols/conn
|
|
|
|
redef record Conn::Info += {
|
|
orig_name: string &log &optional;
|
|
resp_name: string &log &optional;
|
|
};
|
|
|
|
hook Log::log_stream_policy(rec: Conn::Info, id: Log::ID)
|
|
{
|
|
if ( id != Conn::LOG )
|
|
return;
|
|
|
|
print network_time(), "log_stream_policy", id, rec;
|
|
|
|
local token1 = Log::delay(id, rec, function(rec2: Conn::Info, id2: Log::ID): bool {
|
|
print network_time(), "token1 delay hook";
|
|
return T;
|
|
});
|
|
local token2 = Log::delay(id, rec, function(rec2: Conn::Info, id2: Log::ID): bool {
|
|
print network_time(), "token2 delay hook";
|
|
return T;
|
|
});
|
|
|
|
when [id, rec, token1] ( local orig_name = lookup_addr(rec$id$orig_h) )
|
|
{
|
|
rec$orig_name = orig_name;
|
|
Log::delay_finish(id, rec, token1);
|
|
}
|
|
timeout 150msec
|
|
{
|
|
Reporter::warning(fmt("lookup_addr timeout for %s", rec$id$orig_h));
|
|
}
|
|
|
|
when [id, rec, token2] ( local resp_name = lookup_addr(rec$id$resp_h) )
|
|
{
|
|
rec$resp_name = resp_name;
|
|
Log::delay_finish(id, rec, token2);
|
|
}
|
|
timeout 150msec
|
|
{
|
|
Reporter::warning(fmt("lookup_addr timeout for %s", rec$id$resp_h));
|
|
}
|
|
}
|
|
|
|
event Pcap::file_done(path: string)
|
|
{
|
|
print network_time(), "Pcap::file_done";
|
|
}
|