Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

packet_analysis: Raise violations once (and don't raise confirmations after violations)

Browse source 
This is mostly to avoid per-packet violations for packet analyzers that
have sessions attached to them.
This commit is contained in:
Arne Welzel 2022-09-26 15:10:47 +02:00
parent 700a9a4f37
commit fdedc6b200
2 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/packet_analysis/Analyzer.cc
View file

@ -189,6 +189,10 @@ void Analyzer::AnalyzerConfirmation(session::Session* session, zeek::Tag arg_tag
if ( session->AnalyzerState(effective_tag) == session::AnalyzerConfirmationState::CONFIRMED )
return;
// If this session violated previously, we don't allow through a confirmation.
if ( session->AnalyzerState(effective_tag) == session::AnalyzerConfirmationState::VIOLATED )
return;
session->SetAnalyzerState(effective_tag, session::AnalyzerConfirmationState::CONFIRMED);
if ( analyzer_confirmation_info )
@ -238,6 +242,9 @@ void Analyzer::AnalyzerViolation(const char* reason, session::Session* session,
{
const auto& effective_tag = arg_tag ? arg_tag : GetAnalyzerTag();
if ( session->AnalyzerState(effective_tag) == session::AnalyzerConfirmationState::VIOLATED )
return;
session->SetAnalyzerState(effective_tag, session::AnalyzerConfirmationState::VIOLATED);
if ( analyzer_violation_info )