Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Remove setting non-existent session history for IPTunnel

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-01-23 11:22:41 -07:00
parent a3af4a4b51
commit 8977f49665
3 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -23,7 +23,6 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
}
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet);
return false;
}

12
testing/btest/Baseline/core.tunnels.gre-in-gre-min-depth/weird.log Normal file
View file

@ -0,0 +1,12 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX - 10.10.11.2 0 10.10.13.2 0 exceeded_tunnel_max_depth_in_tunnel - F zeek IPTUNNEL
XXXXXXXXXX.XXXXXX - 10.10.13.2 0 10.10.11.2 0 exceeded_tunnel_max_depth_in_tunnel - F zeek IPTUNNEL
#close XXXX-XX-XX-XX-XX-XX

3
testing/btest/core/tunnels/gre-in-gre-min-depth.test Normal file
View file

@ -0,0 +1,3 @@
# @TEST-DOC: Tests that an IP-in-IP tunnel with max-depth set to 1 doesn't crash
# @TEST-EXEC: zeek -C -r $TRACES/tunnels/gre-within-gre.pcap Tunnel::max_depth=1
# @TEST-EXEC: btest-diff weird.log