diff --git a/CHANGES b/CHANGES index 5b9fd6426d..24f31c3874 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,19 @@ +2.4-729 | 2016-08-01 08:00:54 -0700 + + * Fix behavior of connection_pending event. It is now really only + raised when Bro is terminating. Also adds a test-case that raises + the event. (Johanna Amann) + + * Retired remove -J/-K options (set md5/hash key) from the manpage. + They had already been removed from the code. (Johanna Amann) + + * NetControl: Add catch-and-release event when IPs are forgotten. + This adds an event catch_release_forgotten() that is raised once + Catch & Release ceases block management for an IP address because + the IP has not been seen in traffic during the watch interval. + (Johanna Amann) + 2.4-723 | 2016-07-26 15:04:26 -0700 * Add error events to input framework. (Johanna Amann) diff --git a/VERSION b/VERSION index b869a50c3f..b092ef10ce 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4-723 +2.4-729 diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index 17b99abb39..791cf9f779 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -355,7 +355,7 @@ void TCP_Analyzer::Done() { Analyzer::Done(); - if ( connection_pending && is_active && ! BothClosed() ) + if ( terminating && connection_pending && is_active && ! BothClosed() ) Event(connection_pending); LOOP_OVER_GIVEN_CHILDREN(i, packet_children) diff --git a/testing/btest/Baseline/scripts.base.protocols.tcp.pending/.stdout b/testing/btest/Baseline/scripts.base.protocols.tcp.pending/.stdout new file mode 100644 index 0000000000..84858cb67b --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.tcp.pending/.stdout @@ -0,0 +1 @@ +1469573308.013636, Connection pending, [orig_h=192.168.4.149, orig_p=55881/tcp, resp_h=74.125.239.152, resp_p=443/tcp], ShADad diff --git a/testing/btest/scripts/base/protocols/tcp/pending.bro b/testing/btest/scripts/base/protocols/tcp/pending.bro new file mode 100644 index 0000000000..1a49f5d19b --- /dev/null +++ b/testing/btest/scripts/base/protocols/tcp/pending.bro @@ -0,0 +1,7 @@ +# @TEST-EXEC: bro -C -r $TRACES/tls/chrome-34-google.trace %INPUT +# @TEST-EXEC: btest-diff .stdout + +event connection_pending(c: connection) + { + print current_time(), "Connection pending", c$id, c$history; + }