Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Update public and private test suite for DPD changes.

Browse source 
The changes are mostly quite minor. The main change reasons are:

* analyzers that were confirmed, and later removed now show up in the
  conn.log.
* a couple of removed lines in analyzer.log, because non-confirmed
  analyzers get removed more quickly.
* in some cases there are additional lines in analyzer.log. These are
  cases in which an analyzer gets removed due to a violation and then
  re-attached because of a later signature match, which replays the
  violating content. In all examples that I have so far, this is caused
  by both sides of a connection speaking a differing protocol. There
  probably should be a better way to handle this - but it works.
* new column for failed analyzers in conn.log
This commit is contained in:
Johanna Amann 2025-01-29 14:07:38 +00:00
parent 2f712c3c24
commit 20ace6209f
3 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/external/scripts/testing-setup.zeek vendored
View file

@ -1,6 +1,7 @@
# Sets some testing specific options.
@load external-ca-list
@load protocols/conn/failed-services
@ifdef ( SMTP::never_calc_md5 )
# MDD5s can depend on libmagic output.