From 4281d704c1138d2e8322ea669d8a4cb81d95d859 Mon Sep 17 00:00:00 2001 From: Christian Kreibich Date: Fri, 10 Feb 2023 15:44:43 -0800 Subject: [PATCH] Tighten local-nets filtering in the logging framework's path-func-column-demote test With private addresses treated as local ones, this picked up some private-range flows in the test pcap involved. --- .../base/frameworks/logging/path-func-column-demote.zeek | 3 +++ 1 file changed, 3 insertions(+) diff --git a/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek b/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek index 7b256da666..40f8043801 100644 --- a/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek +++ b/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek @@ -9,6 +9,9 @@ @load base/protocols/conn @load base/frameworks/notice +# Don't automatically treat private address space as local here so we filter +# precisely on a single local prefix: +redef Site::private_address_space_is_local = F; redef Site::local_nets = {141.142.0.0/16}; function split_log(id: Log::ID, path: string, rec: record {id:conn_id;}): string