Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/fastpath'

Browse source 
* origin/fastpath:
  Binary packaging script tweaks.
  More default "weird" tuning for the "SYN_with_data" notice.
  Tiny bugfix for http file extraction along with test.
This commit is contained in:
Robin Sommer 2011-11-14 20:09:28 -08:00
commit fa76330afb
11 changed files with 340 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/frameworks/notice/weird.bro
View file

@ -174,7 +174,7 @@ export {
["SYN_after_reset"] = ACTION_LOG,
["SYN_inside_connection"] = ACTION_LOG,
["SYN_seq_jump"] = ACTION_LOG,
["SYN_with_data"] = ACTION_LOG,
["SYN_with_data"] = ACTION_LOG_PER_ORIG,
["TCP_christmas"] = ACTION_LOG,
["truncated_ARP"] = ACTION_LOG,
["truncated_NTP"] = ACTION_LOG,

3
scripts/base/protocols/http/file-extract.bro
View file

@ -33,7 +33,8 @@ export {
event http_entity_data(c: connection, is_orig: bool, length: count, data: string) &priority=5
{
# Client body extraction is not currently supported in this script.
if ( is_orig || ! c$http$first_chunk ) return;
if ( is_orig )
return;
if ( c$http$first_chunk )
{