Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add analyzer_confirmation and analyzer_violation events

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-10-25 09:03:15 -07:00
parent 7bffd2eccd
commit 612212568a
96 changed files with 432 additions and 235 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/dns/DNS.cc
View file

@ -59,7 +59,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
// This should weed out most of it.
if ( zeek::detail::dns_max_queries > 0 && msg.qdcount > zeek::detail::dns_max_queries )
{
analyzer->ProtocolViolation("DNS_Conn_count_too_large");
analyzer->AnalyzerViolation("DNS_Conn_count_too_large");
analyzer->Weird("DNS_Conn_count_too_large");
EndMessage(&msg);
return;
@ -82,7 +82,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
return;
}
analyzer->ProtocolConfirmation();
analyzer->AnalyzerConfirmation();
int skip_auth = zeek::detail::dns_skip_all_auth;
int skip_addl = zeek::detail::dns_skip_all_addl;