mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
fix a few syntax errors
This commit is contained in:
parent
8fce51bf83
commit
0849332eb9
8 changed files with 53 additions and 11 deletions
10
conn.log
Normal file
10
conn.log
Normal file
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2021-09-29-11-39-42
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1632928690.500620 CvVbVi3kNVC4LPU90f 192.168.1.99 62978 192.168.1.1 53 udp dns 0.027648 55 134 SF - - 0 Dd 1 83 1 162 -
|
||||
#close 2021-09-29-11-39-42
|
10
dns.log
Normal file
10
dns.log
Normal file
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path dns
|
||||
#open 2021-09-29-11-39-42
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z answers TTLs rejected auth addl
|
||||
#types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count vector[string] vector[interval] bool set[string] set[string]
|
||||
1632928690.500620 CvVbVi3kNVC4LPU90f 192.168.1.99 62978 192.168.1.1 53 udp 62111 - cloudflare.com 1 C_INTERNET 65 HTTPS 0 NOERROR F F T F 2 - - F - -
|
||||
#close 2021-09-29-11-39-42
|
10
packet_filter.log
Normal file
10
packet_filter.log
Normal file
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path packet_filter
|
||||
#open 2021-09-29-11-39-42
|
||||
#fields ts node filter init success
|
||||
#types time string string bool bool
|
||||
1632929982.504499 zeek ip or not ip T T
|
||||
#close 2021-09-29-11-39-42
|
|
@ -3888,7 +3888,7 @@ type dns_svcb_rr: record {
|
|||
svc_priority: count; ##< Service priority. (AliasMode? ServiceMode?)
|
||||
target_name: string; ##< Target name, the hostname of the service endpoint.
|
||||
svc_params: table[count] of vector of string; ##< service parameters as key-value pairs
|
||||
}
|
||||
};
|
||||
|
||||
# DNS answer types.
|
||||
#
|
||||
|
|
|
@ -1709,7 +1709,7 @@ bool DNS_Interpreter::ParseRR_SVCB(detail::DNS_MsgInfo* msg, const u_char*& data
|
|||
SVCB_DATA svcb_data = {
|
||||
.svc_priority = svc_priority,
|
||||
.target_name = new String(target_name, name_end - target_name, true),
|
||||
.svc_params = nullptr,
|
||||
.svc_params = Dictionary(),
|
||||
};
|
||||
|
||||
// TODO: parse svcparams
|
||||
|
@ -2037,7 +2037,7 @@ RecordValPtr DNS_MsgInfo::BuildSVCB_Val(SVCB_DATA* svcb)
|
|||
r->Assign(1, make_intrusive<StringVal>(svcb->target_name));
|
||||
|
||||
// TODO: assign svcparams
|
||||
return dns_svcb_rr;
|
||||
return r;
|
||||
}
|
||||
|
||||
} // namespace detail
|
||||
|
|
|
@ -287,14 +287,7 @@ struct SVCB_DATA
|
|||
{
|
||||
unsigned short svc_priority; // 2
|
||||
String* target_name;
|
||||
SVCPARAM_KV* svc_params;
|
||||
}
|
||||
|
||||
struct SVCPARAM_KV
|
||||
{
|
||||
String* key;
|
||||
String* value;
|
||||
SVCPARAM_KV* next;
|
||||
Dictionary svc_params;
|
||||
};
|
||||
|
||||
class DNS_MsgInfo
|
||||
|
|
9
testing/btest/scripts/base/protocols/dns/svcb.zeek
Normal file
9
testing/btest/scripts/base/protocols/dns/svcb.zeek
Normal file
|
@ -0,0 +1,9 @@
|
|||
# @TEST-EXEC: zeek -C -r $TRACES/dns-https.pcap %INPUT > output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
@load policy/protocols/dns/auth-addl
|
||||
|
||||
event dns_HTTPS(c: connection, msg: dns_msg, ans: dns_answer, https: dns_svcb_rr)
|
||||
{
|
||||
print https;
|
||||
}
|
10
weird.log
Normal file
10
weird.log
Normal file
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path weird
|
||||
#open 2021-09-29-11-39-42
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
|
||||
#types time string addr port addr port string string bool string string
|
||||
1632928690.528268 CvVbVi3kNVC4LPU90f 192.168.1.99 62978 192.168.1.1 53 DNS_truncated_RR_rdlength_lt_len - F zeek DNS
|
||||
#close 2021-09-29-11-39-42
|
Loading…
Add table
Add a link
Reference in a new issue