Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed insertion of nested subnets.

Browse source 
When inserting, existance of the given subnet is checked using exact
matching instead of longest prefix matching. Before, inserting a subnet
would have updated the subnet item, which is the longest prefix of the
inserted subnet, if present.
This commit is contained in:
Jan Grashoefer 2016-06-22 21:14:06 +02:00
parent 1412de1798
commit df5d9adfb4
3 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
testing/btest/scripts/base/frameworks/intel/match-subnet.bro
View file

@ -10,6 +10,7 @@
192.168.2.0/24 Intel::SUBNET source1 this subnetwork is just plain baaad http://some-data-distributor.com/2
192.168.142.1 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/3
192.168.142.0/24 Intel::SUBNET source1 this subnetwork is baaad http://some-data-distributor.com/4
192.168.142.0/26 Intel::SUBNET source1 this subnetwork is inside http://some-data-distributor.com/4
192.168.128.0/18 Intel::SUBNET source1 this subnetwork might be baaad http://some-data-distributor.com/5
# @TEST-END-FILE
@ -47,4 +48,4 @@ event Intel::match(s: Intel::Seen, items: set[Intel::Item])
print fmt("Seen: %s", s);
for ( item in items )
print fmt("Item: %s", item);
}
}