Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/community-id-logging-connection-state-remove'

Browse source 
* origin/topic/awelzel/community-id-logging-connection-state-remove:
  Bump external test suites
  policy/community-id: Do not use new_connection()
This commit is contained in:
Arne Welzel 2023-05-11 00:01:20 +02:00
commit 31d5c15573
6 changed files with 15 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

9
CHANGES
View file

@ -1,3 +1,12 @@
6.0.0-dev.544 | 2023-05-11 00:01:20 +0200
* GH-3028: policy/community-id: Do not use new_connection() (Arne Welzel, Corelight)
Issue #3028 tracks how a flipped connections reset a connection's value
including any state set during new_connection(). For the time being,
update community-id functionality back to the original connection_state_remove()
approach to avoid missing community_ids on flipped connections.
6.0.0-dev.541 | 2023-05-10 23:16:24 +0200 6.0.0-dev.541 | 2023-05-10 23:16:24 +0200
* testing/zeek-version-link: Assume nm is there (Arne Welzel, Corelight) * testing/zeek-version-link: Assume nm is there (Arne Welzel, Corelight)

2
VERSION
View file

@ -1 +1 @@
6.0.0-dev.541 6.0.0-dev.544

11
scripts/policy/frameworks/notice/community-id.zeek
View file

@ -22,14 +22,7 @@ export {
hook Notice::notice(n: Notice::Info) hook Notice::notice(n: Notice::Info)
{ {
if ( CommunityID::Notice::enabled && n?$conn && n$conn?$conn ) if ( CommunityID::Notice::enabled && n?$conn )
{ n$community_id = community_id_v1(n$conn$id);
local info = n$conn$conn;
# This is set during new_connection(), so it should
# always be there, but better safe than sorry.
if ( info?$community_id )
n$community_id = info$community_id;
}
} }
@endif @endif

5
scripts/policy/protocols/conn/community-id-logging.zeek
View file

@ -17,10 +17,7 @@ export {
}; };
} }
module Conn; event connection_state_remove(c: connection)
event new_connection(c: connection)
{ {
Conn::set_conn(c, F); # likely first to access :-/
c$conn$community_id = community_id_v1(c$id, CommunityID::seed, CommunityID::do_base64); c$conn$community_id = community_id_v1(c$id, CommunityID::seed, CommunityID::do_base64);
} }

2
testing/external/commit-hash.zeek-testing vendored
View file

@ -1 +1 @@
63952e0fc5c88ff44752c586abe721ccb324003e 828845c99306c6d5d6811fa42987de5b16f530b9

2
testing/external/commit-hash.zeek-testing-private vendored
View file

@ -1 +1 @@
e16f299e2ddad6a3495113ff7b26120b6312b220 4d5c6de8c1d36b8fcbacab7da45fee79a433844e