Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

packet_analysis: Raise violations once (and don't raise confirmations after violations)

Browse source 
This is mostly to avoid per-packet violations for packet analyzers that
have sessions attached to them.
This commit is contained in:
Arne Welzel 2022-09-26 15:10:47 +02:00
parent 700a9a4f37
commit fdedc6b200
2 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
NEWS
View file

@ -20,6 +20,13 @@ New Functionality
- File analyzers can now raise analyzer violations to the script-layer via
the new AnalyzerViolation() method.
Changed Functionality
---------------------
- Violations for packet analyzers that have sessions attached with them
will be raised once only. Further, analyzer confirmations are not raised
after a violation.
Deprecated Functionality
------------------------

7
src/packet_analysis/Analyzer.cc
View file

@ -189,6 +189,10 @@ void Analyzer::AnalyzerConfirmation(session::Session* session, zeek::Tag arg_tag
if ( session->AnalyzerState(effective_tag) == session::AnalyzerConfirmationState::CONFIRMED )
return;
// If this session violated previously, we don't allow through a confirmation.
if ( session->AnalyzerState(effective_tag) == session::AnalyzerConfirmationState::VIOLATED )
return;
session->SetAnalyzerState(effective_tag, session::AnalyzerConfirmationState::CONFIRMED);
if ( analyzer_confirmation_info )
@ -238,6 +242,9 @@ void Analyzer::AnalyzerViolation(const char* reason, session::Session* session,
{
const auto& effective_tag = arg_tag ? arg_tag : GetAnalyzerTag();
if ( session->AnalyzerState(effective_tag) == session::AnalyzerConfirmationState::VIOLATED )
return;
session->SetAnalyzerState(effective_tag, session::AnalyzerConfirmationState::VIOLATED);
if ( analyzer_violation_info )