Allow to track service violations in conn.log.

This introduces ian options, DPD::track_removed_services_in_connection.
It adds failed services to the services column, prefixed with a
"-".

Alternatively, this commit also adds
policy/protocols/conn/failed-services.zeek, which provides the same
information in a new column in conn.log.
This commit is contained in:
Johanna Amann 2025-01-30 16:32:32 +00:00
parent ac7bbe6949
commit 2f712c3c24
8 changed files with 67 additions and 6 deletions

View file

@ -0,0 +1,7 @@
# @TEST-DOC: Check if DPD options on violations work.
# @TEST-EXEC: zeek -r $TRACES/ftp/ftp-invalid-reply-code.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
@load policy/protocols/conn/failed-services
redef DPD::track_removed_services_in_connection = T;