mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
Fixes for GeoIP support (addresses #538).
- Missing GeoIP databases now generate warnings/errors that go through the reporter framework instead of hitting GeoIP's internal use of stderr - lookup_location now just queries for country code if the city database was not loaded, which gets rid of invalid database type errors. - lookup_location now leaves missing fields uninitialized in the returned geo_location record value. Updated existing scripts to check for initialized fields in geo_location records before use. - Fixed support for GeoIP's IPv6 API and databases
This commit is contained in:
parent
005b1505b8
commit
13a09aa488
5 changed files with 99 additions and 43 deletions
|
@ -33,7 +33,7 @@ event SSH::heuristic_successful_login(c: connection) &priority=5
|
|||
# Add the location data to the SSH record.
|
||||
c$ssh$remote_location = location;
|
||||
|
||||
if ( location$country_code in watched_countries )
|
||||
if ( location?$country_code && location$country_code in watched_countries )
|
||||
{
|
||||
NOTICE([$note=Login_From_Watched_Country,
|
||||
$conn=c,
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue