Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 02:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

GH-1507: Tolerate junk data before SIP requests

Browse source 
This allows for data that won't match a SIP request method to precede an
actual request and generates a new 'sip_junk_before_request' weird when
encountering such a situation.
This commit is contained in:
Jon Siwek 2021-04-14 15:34:07 -07:00
parent 0c93e2fcb8
commit 183789294f
6 changed files with 47 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/scripts/base/protocols/sip/junk.zeek Normal file
View file

@ -0,0 +1,8 @@
# This tests a PCAP with a few SIP commands from the Wireshark samples.
# @TEST-EXEC: zeek -b -r $TRACES/sip/sip-junk-before-request.pcap %INPUT
# @TEST-EXEC: btest-diff sip.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/sip
@load base/frameworks/notice/weird