Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

DPD changes - small script fixes and renames.

Browse source 
This addresses review feedback of GH-4200. No functional changes.
This commit is contained in:
Johanna Amann 2025-02-05 13:55:43 +00:00
parent 6324445d62
commit e3493bc110
6 changed files with 8 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/frameworks/analyzer/dpd.zeek
View file

@ -125,7 +125,7 @@ event analyzer_violation_info(atype: AllAnalyzers::Tag, info: AnalyzerViolationI
# add "-service" to the list of services on removal due to violation, if analyzer was confirmed before
if ( track_removed_services_in_connection && disabled && Analyzer::name(atype) in c$service )
{
local rname = fmt("-%s", Analyzer::name(atype));
local rname = cat("-", Analyzer::name(atype));
if ( rname !in c$service )
add c$service[rname];
}

11
scripts/base/protocols/conn/main.zeek
View file

@ -27,13 +27,10 @@ export {
id: conn_id &log;
## The transport layer protocol of the connection.
proto: transport_proto &log;
## The identification of the application protocol(s) being sent over
## the connection. Can list more than one protocol separated with
## colons. Protocols listed are in the order in which they are
## confirmed.
## This field can also contain a list of protocol analyzers that
## raise violations prefixed with a "-" if the option
## :zeek:see:`DPD::track_removed_services_in_connection` is set.
## A comma-separated list of confirmed protocol(s).
## With :zeek:see:DPD::track_removed_services_in_connection, the list
## includes the same protocols prefixed with "-" to record that Zeek
## dropped them due to parsing violations."
service: string &log &optional;
## How long the connection lasted.
##