Add replay filter syntax: ~replay, ~replayq, ~replays

This commit is contained in:
Brad Dixon 2021-05-06 09:23:33 -04:00
parent 518fb94124
commit 69f555f9bb
2 changed files with 42 additions and 0 deletions

View File

@ -382,6 +382,30 @@ class FDst(_Rex):
return f.server_conn.address and self.re.search(r)
class FReplay(_Action):
code = "replay"
help = "Match replayed flows"
def __call__(self, f):
return f.is_replay is not None
class FReplayClient(_Action):
code = "replayq"
help = "Match replayed client request"
def __call__(self, f):
return f.is_replay == 'request'
class FReplayServer(_Action):
code = "replays"
help = "Match replayed server response"
def __call__(self, f):
return f.is_replay == 'response'
class _Int(_Action):
def __init__(self, num):
@ -444,6 +468,9 @@ filter_unary: Sequence[Type[_Action]] = [
FErr,
FHTTP,
FMarked,
FReplay,
FReplayClient,
FReplayServer,
FReq,
FResp,
FTCP,

View File

@ -24,6 +24,9 @@ class TestParsing:
assert flowfilter.parse("~m foobar")
assert flowfilter.parse("~u foobar")
assert flowfilter.parse("~q ~c 10")
assert flowfilter.parse("~replay")
assert flowfilter.parse("~replayq")
assert flowfilter.parse("~replays")
p = flowfilter.parse("~q ~c 10")
self._dump(p)
assert len(p.lst) == 2
@ -296,6 +299,18 @@ class TestMatchingHTTPFlow:
assert self.q("!~c 201 !~c 202", s)
assert not self.q("!~c 201 !~c 200", s)
def test_replay(self):
f = tflow.tflow()
assert not self.q("~r", f)
f.is_replay = "request"
assert self.q("~r", f)
assert self.q("~rc", f)
assert not self.q("~rs", f)
f.is_replay = "response"
assert self.q("~r", f)
assert not self.q("~rc", f)
assert self.q("~rs", f)
class TestMatchingTCPFlow: