diff --git a/CHANGES b/CHANGES index 6516015549..259b322637 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,12 @@ +6.0.0-dev.544 | 2023-05-11 00:01:20 +0200 + + * GH-3028: policy/community-id: Do not use new_connection() (Arne Welzel, Corelight) + + Issue #3028 tracks how a flipped connections reset a connection's value + including any state set during new_connection(). For the time being, + update community-id functionality back to the original connection_state_remove() + approach to avoid missing community_ids on flipped connections. + 6.0.0-dev.541 | 2023-05-10 23:16:24 +0200 * testing/zeek-version-link: Assume nm is there (Arne Welzel, Corelight) diff --git a/VERSION b/VERSION index 984b460d74..3b81a39e43 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.0.0-dev.541 +6.0.0-dev.544 diff --git a/scripts/policy/frameworks/notice/community-id.zeek b/scripts/policy/frameworks/notice/community-id.zeek index 5f16b64285..122d3adba5 100644 --- a/scripts/policy/frameworks/notice/community-id.zeek +++ b/scripts/policy/frameworks/notice/community-id.zeek @@ -22,14 +22,7 @@ export { hook Notice::notice(n: Notice::Info) { - if ( CommunityID::Notice::enabled && n?$conn && n$conn?$conn ) - { - local info = n$conn$conn; - # This is set during new_connection(), so it should - # always be there, but better safe than sorry. - if ( info?$community_id ) - n$community_id = info$community_id; - } + if ( CommunityID::Notice::enabled && n?$conn ) + n$community_id = community_id_v1(n$conn$id); } - @endif diff --git a/scripts/policy/protocols/conn/community-id-logging.zeek b/scripts/policy/protocols/conn/community-id-logging.zeek index 82bb9049a5..a08430727b 100644 --- a/scripts/policy/protocols/conn/community-id-logging.zeek +++ b/scripts/policy/protocols/conn/community-id-logging.zeek @@ -17,10 +17,7 @@ export { }; } -module Conn; - -event new_connection(c: connection) +event connection_state_remove(c: connection) { - Conn::set_conn(c, F); # likely first to access :-/ c$conn$community_id = community_id_v1(c$id, CommunityID::seed, CommunityID::do_base64); } diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing index 275024bf19..d57e1cb4df 100644 --- a/testing/external/commit-hash.zeek-testing +++ b/testing/external/commit-hash.zeek-testing @@ -1 +1 @@ -63952e0fc5c88ff44752c586abe721ccb324003e +828845c99306c6d5d6811fa42987de5b16f530b9 diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private index 8279cfae9b..3a600fa811 100644 --- a/testing/external/commit-hash.zeek-testing-private +++ b/testing/external/commit-hash.zeek-testing-private @@ -1 +1 @@ -e16f299e2ddad6a3495113ff7b26120b6312b220 +4d5c6de8c1d36b8fcbacab7da45fee79a433844e