Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'dns-original-query-case' of https://github.com/rvictory/zeek

Browse source 
Changes during merge
- Changed the policy script to use an event handler that behaves
  for like the base script: &priority=5, msg$opcode != early-out,
  no record field existence checks
- Also extended dns_query_reply event with original_query param
- Removed ExtractName overload, and just use default param

* 'dns-original-query-case' of https://github.com/rvictory/zeek:
  Fixed some places where tabs became spaces
  Stricter checking if we have a dns field on the connection being processed
  Modified the DNS protocol analyzer to add a new parameter to the dns_request event which includes the DNS query in its original case. Added a policy script that will add the original_case to the dns.log file as well. Created new btests to test both.
This commit is contained in:
Jon Siwek 2020-06-25 23:33:14 -07:00
commit 00a4865885
14 changed files with 87 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/external/commit-hash.zeek-testing-private vendored
View file

@ -1 +1 @@
fa5c4dc4ea3481c7b273f0cfcc77497c0d32aa7c
d6cd639023cfe26c4e2cf14a59e78599b22ed4d0