Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/johanna/gh-4656'

Browse source 
* origin/topic/johanna/gh-4656:
  Fix parsing of EDNS rcode
This commit is contained in:
Tim Wojtulewicz 2025-07-28 14:16:16 -07:00
commit 22fc57a90a
6 changed files with 32 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/protocols/dns/edns-rcode.zeek Normal file
View file

@ -0,0 +1,13 @@
# @TEST-DOC: Tests that the correct extended rcode is returned for EDNS packets. Regression test for #4656.
# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dns_extended_rcode.pcap %INPUT > output
# @TEST-EXEC: btest-diff output
@load base/protocols/dns
redef dns_skip_all_addl=F;
event dns_EDNS_addl(c: connection, msg: dns_msg, ans: dns_edns_additional)
{
if ( c$dns?$rcode && ans?$extended_rcode )
print ans$extended_rcode;
}