Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Allow to handle late DPD matches.

Browse source 
If dpd_match_only_beginning is disabled, matches of protocol signatures
can be handeld using protocol_late_match. To prevent further matching in
this case, dpd_late_match_stop may be activated.
This commit is contained in:
Jan Grashoefer 2019-08-21 18:38:09 +02:00
parent 8ab0650c1e
commit 5901b6d33c
5 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/NetVar.cc
View file

@ -164,6 +164,7 @@ RecordType* irc_join_info;
int dpd_reassemble_first_packets;
int dpd_buffer_size;
int dpd_match_only_beginning;
int dpd_late_match_stop;
int dpd_ignore_ports;
TableVal* likely_server_ports;
@ -406,6 +407,7 @@ void init_net_var()
opt_internal_int("dpd_reassemble_first_packets");
dpd_buffer_size = opt_internal_int("dpd_buffer_size");
dpd_match_only_beginning = opt_internal_int("dpd_match_only_beginning");
dpd_late_match_stop = opt_internal_int("dpd_late_match_stop");
dpd_ignore_ports = opt_internal_int("dpd_ignore_ports");
likely_server_ports = internal_val("likely_server_ports")->AsTableVal();