Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

GH-2261: Fix type used for analyzer_confirmation/violation events

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-07-13 12:50:15 -07:00
parent 48486b4156
commit ec450147e6
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/event.bif
View file

@ -377,7 +377,7 @@ event content_gap%(c: connection, is_orig: bool, seq: count, length: count%);
## Zeek's default scripts use this event to determine the ``service`` column
## of :zeek:type:`Conn::Info`: once confirmed, the protocol will be listed
## there (and thus in ``conn.log``).
event analyzer_confirmation%(c: connection, atype: Analyzer::Tag, aid: count%);
event analyzer_confirmation%(c: connection, atype: AllAnalyzers::Tag, aid: count%);
## Generated if a DPD signature matched but the DPD buffer is already exhausted
## and thus the analyzer could not be attached. While this does not confirm
@ -420,7 +420,7 @@ event protocol_late_match%(c: connection, atype: Analyzer::Tag%);
## :zeek:id:`disable_analyzer` if it's parsing the wrong protocol. That's
## however a script-level decision and not done automatically by the event
## engine.
event analyzer_violation%(c: connection, atype: Analyzer::Tag, aid: count, reason: string%);
event analyzer_violation%(c: connection, atype: AllAnalyzers::Tag, aid: count, reason: string%);
## Generated when a TCP connection terminated, passing on statistics about the
## two endpoints. This event is always generated when Zeek flushes the internal