diff --git a/CHANGES b/CHANGES index 1a39872cee..d097e91568 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,10 @@ +3.1.0-dev.7 | 2019-08-09 09:56:06 -0700 + + * Remove empty services from known_services.log (Mauro Palumbo) + + * Add check to log to known_services.log when removing active udp connections (Mauro Palumbo) + 3.1.0-dev.5 | 2019-08-09 09:33:22 -0700 * Add Intel::read_error event to allow custom error handling (Mauro Palumbo) diff --git a/VERSION b/VERSION index 8edae5f781..46e9218943 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.1.0-dev.5 +3.1.0-dev.7 diff --git a/scripts/policy/protocols/conn/known-services.zeek b/scripts/policy/protocols/conn/known-services.zeek index 24774586dc..7feea978d2 100644 --- a/scripts/policy/protocols/conn/known-services.zeek +++ b/scripts/policy/protocols/conn/known-services.zeek @@ -210,7 +210,10 @@ event connection_state_remove(c: connection) &priority=-5 if ( c$known_services_done ) return; - if ( c$resp$state != TCP_ESTABLISHED ) + if ( c$resp$state != TCP_ESTABLISHED && c$resp$state != UDP_ACTIVE ) + return; + + if ( |c$service| == 0 ) return; known_services_done(c); diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing index 9ac9662c8e..4c877406cd 100644 --- a/testing/external/commit-hash.zeek-testing +++ b/testing/external/commit-hash.zeek-testing @@ -1 +1 @@ -4e78e7e6f9baf56ec6303d2580f380628fd31e36 +5e5a5e8dbb94215a7ca1def810f4bbe0322bc72e diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private index b69a84b06b..5208dd575f 100644 --- a/testing/external/commit-hash.zeek-testing-private +++ b/testing/external/commit-hash.zeek-testing-private @@ -1 +1 @@ -6fef8f0d8eb896856fa72551af65668d0ea01bf4 +b7cf5aa8224fb39baf7497d187f48165fad050da