Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

DPD: change policy script for service violation logging; add NEWS

Browse source 
This commit renames the `service_violation` column that can be added via
a policy script to `failed_service`. This expresses the intent of it
better - the column contains services that failed and were removed after
confirmation.

Furthermore, the script is fixed so it actually does this - before it
would sometimes add services to the list that were not actually removed.
In the course of this, the type of the column was changed from a vector
to an ordered set.

Due to the column rename, the policy script itself is also renamed.

Also adds a NEWS entry for the DPD changes.
This commit is contained in:
Johanna Amann 2025-02-05 16:42:26 +00:00
parent e3493bc110
commit 0fa1ecce8f
7 changed files with 84 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/base/frameworks/analyzer/dpd-logging-configuration.zeek
View file

@ -2,6 +2,6 @@
# @TEST-EXEC: zeek -r $TRACES/ftp/ftp-invalid-reply-code.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
@load policy/protocols/conn/service-violation-logging
@load policy/protocols/conn/failed-service-logging
redef DPD::track_removed_services_in_connection = T;