Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

IPv6 support for detect-external-names and testcase

Browse source 
This commit builds on top of GH-4183 and adds IPv6 support for
policy/protocols/dns/detect-external-names.

Additionally it adds a test-case for this file testing it with mDNS
queries.
This commit is contained in:
Johanna Amann 2025-02-04 12:28:41 +00:00
parent 83926f60ce
commit 7a1a2c8d63
5 changed files with 52 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/policy/protocols/dns/detect-external-names.zeek
View file

@ -20,7 +20,7 @@ export {
option skip_resp_host_port_pairs: set[addr, port] = { [[224.0.0.251, [ff02::fb]], 5353/udp] };
}
event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) &priority=-3
function detect_external_names(c: connection, msg: dns_msg, ans: dns_answer, a: addr)
{
if ( |Site::local_zones| == 0 )
return;
@ -39,3 +39,13 @@ event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) &priori
$identifier=cat(a,ans$query)]);
}
}
event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr)
{
detect_external_names(c, msg, ans, a);
}
event dns_AAAA_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr)
{
detect_external_names(c, msg, ans, a);
}