Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Spicy: Fix service reporting for replaced analyzers.

Browse source 
We accidentally applied analyzer mappings when looking up an
analyzer's name from scriptland.

Closes #3725.
This commit is contained in:
Robin Sommer 2024-05-08 13:06:03 +02:00
parent 4e6bbd9756
commit 93a424b28a
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
3 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/analyzer.bif
View file

@ -42,11 +42,13 @@ function __name%(atype: AllAnalyzers::Tag%) : string
%{
auto val = atype->AsEnumVal();
plugin::Component* component = zeek::analyzer_mgr->Lookup(val);
// Note that we don't want to follow mappings here, we want the name of
// whatever the user passes in.
plugin::Component* component = zeek::analyzer_mgr->Lookup(val, false);
if ( ! component )
component = zeek::packet_mgr->Lookup(val);
component = zeek::packet_mgr->Lookup(val, false);
if ( ! component )
component = zeek::file_mgr->Lookup(val);
component = zeek::file_mgr->Lookup(val, false);
if ( ! component )
return zeek::make_intrusive<zeek::StringVal>("<error>");
@ -56,11 +58,13 @@ function __name%(atype: AllAnalyzers::Tag%) : string
%%{
static zeek::plugin::Component* component_for_name(const char* name)
{
// Note that we don't want to follow mappings here, we want the name of
// whatever the user passes in.
zeek::plugin::Component* component = zeek::analyzer_mgr->Lookup(name);
if ( ! component )
component = zeek::packet_mgr->Lookup(name);
component = zeek::packet_mgr->Lookup(name, false);
if ( ! component )
component = zeek::file_mgr->Lookup(name);
component = zeek::file_mgr->Lookup(name, false);
return component;
}

11
testing/btest/Baseline/spicy.replaces/conn.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.16.238.1 49656 172.16.238.131 80 tcp ssh 9.953807 2405 2887 SF T T 0 ShAdDaFf 40 4497 30 4455 -
#close XXXX-XX-XX-XX-XX-XX

1
testing/btest/spicy/replaces.zeek
View file

@ -5,6 +5,7 @@
# @TEST-EXEC: ZEEK_SPICY_MODULE_PATH=$(pwd)/modules zeek -r ${TRACES}/ssh/single-conn.trace %INPUT | sort >>output
# @TEST-EXEC: ZEEK_SPICY_MODULE_PATH=$(pwd)/modules zeek -r ${TRACES}/ssh/ssh-on-port-80.trace %INPUT | sort >>output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff conn.log
#
# We use the module search path for loading here as a regression test for #137.
# Note that this that problem only showed up when the Spicy plugin was built