Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/johanna/gh-4061'

Browse source 
* origin/topic/johanna/gh-4061:
  Update BiF-tracking, add is_event_handled
  Address review comments and small updates for DNS warnings
  Raise warnings when for DNS events that are not raised due to dns_skip_all_addl
This commit is contained in:
Johanna Amann 2025-01-14 14:36:52 +00:00
commit b2222e97a1
17 changed files with 158 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/protocols/dns/__load__.zeek
View file

@ -1,2 +1,3 @@
@load ./consts
@load ./main
@load ./check-event-handlers

19
scripts/base/protocols/dns/check-event-handlers.zeek Normal file
View file

@ -0,0 +1,19 @@
##! This script checks if DNS event handlers that will not be raised
##! are used and raises a warning in those cases.
module DNS;
event zeek_init() &priority=20
{
if ( ! dns_skip_all_addl )
return;
local addl_functions = ["dns_TSIG_addl", "dns_EDNS_addl", "dns_EDNS_ecs", "dns_EDNS_tcp_keepalive", "dns_EDNS_cookie"];
for ( event_name in addl_functions )
if ( is_event_handled(event_name) )
Reporter::warning(fmt("Used event '%s' will not be raised because 'dns_skip_all_addl' is true", event_name));
if ( is_event_handled("dns_TKEY") )
Reporter::warning("Used event 'dns_TKEY' will not contain any data in 'ans' because 'dns_skip_all_addl' is true");
}