diff --git a/src/analyzer/protocol/dhcp/dhcp-options.pac b/src/analyzer/protocol/dhcp/dhcp-options.pac index 0560f3cdc9..b572f297b3 100644 --- a/src/analyzer/protocol/dhcp/dhcp-options.pac +++ b/src/analyzer/protocol/dhcp/dhcp-options.pac @@ -627,7 +627,16 @@ refine flow DHCP_Flow += { %{ auto client_id = make_intrusive(zeek::BifType::Record::DHCP::ClientID); client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype})); - client_id->Assign(1, make_intrusive(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length()))); + IntrusivePtr sv; + + if ( ${v.client_id.hwtype} == 0 ) + sv = make_intrusive(${v.client_id.hwaddr}.length(), + (const char*)${v.client_id.hwaddr}.begin()); + else + sv = make_intrusive(fmt_mac(${v.client_id.hwaddr}.begin(), + ${v.client_id.hwaddr}.length())); + + client_id->Assign(1, std::move(sv)); ${context.flow}->options->Assign(19, std::move(client_id)); diff --git a/testing/btest/Baseline/scripts.base.protocols.dhcp.hw-type0/out b/testing/btest/Baseline/scripts.base.protocols.dhcp.hw-type0/out new file mode 100644 index 0000000000..041d527cdf --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.dhcp.hw-type0/out @@ -0,0 +1 @@ +dhcp client_id option, [hwtype=0, hwaddr=cisco-cc00.0ac4.0000-Fa0/0] diff --git a/testing/btest/Traces/dhcp/hw-type0.pcap b/testing/btest/Traces/dhcp/hw-type0.pcap new file mode 100644 index 0000000000..c8f314f784 Binary files /dev/null and b/testing/btest/Traces/dhcp/hw-type0.pcap differ diff --git a/testing/btest/scripts/base/protocols/dhcp/hw-type0.zeek b/testing/btest/scripts/base/protocols/dhcp/hw-type0.zeek new file mode 100644 index 0000000000..2ac4cb8f6a --- /dev/null +++ b/testing/btest/scripts/base/protocols/dhcp/hw-type0.zeek @@ -0,0 +1,16 @@ +# @TEST-EXEC: zeek -b -r $TRACES/dhcp/hw-type0.pcap %INPUT >out +# @TEST-EXEC: btest-diff out + +const ports = { 67/udp, 68/udp }; +redef likely_server_ports += { 67/udp }; + +event zeek_init() &priority=5 + { + Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports); + } + +event dhcp_message(c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options) + { + if ( options?$client_id ) + print "dhcp client_id option", options$client_id; + }