Commit graph

4 commits

Author SHA1 Message Date
Jon Siwek
00a4865885 Merge branch 'dns-original-query-case' of https://github.com/rvictory/zeek
Changes during merge
- Changed the policy script to use an event handler that behaves
  for like the base script: &priority=5, msg$opcode != early-out,
  no record field existence checks
- Also extended dns_query_reply event with original_query param
- Removed ExtractName overload, and just use default param

* 'dns-original-query-case' of https://github.com/rvictory/zeek:
  Fixed some places where tabs became spaces
  Stricter checking if we have a dns field on the connection being processed
  Modified the DNS protocol analyzer to add a new parameter to the dns_request event which includes the DNS query in its original case. Added a policy script that will add the original_case to the dns.log file as well. Created new btests to test both.
2020-06-26 00:07:02 -07:00
Ryan Victory
7a91b49f5a Fixed some places where tabs became spaces 2020-06-22 11:17:56 -05:00
Ryan Victory
6736a0c457 Stricter checking if we have a dns field on the connection being processed 2020-06-17 10:41:33 -05:00
Ryan Victory
63d99595fe Modified the DNS protocol analyzer to add a new parameter to the dns_request event which includes the DNS query in its original case. Added a policy script that will add the original_case to the dns.log file as well. Created new btests to test both. 2020-06-17 10:13:04 -05:00