mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
785bb2ee13
When a conn_id represents a ICMP "connection", we need to determine the is_one_way flag for InitTuple() in order to skip any flipping of address and ports for one-way ICMP connections. Fixes #4645
12 lines
575 B
Text
12 lines
575 B
Text
# @TEST-DOC: Test connection_exists() within new_connection() for ICMP traces. Regression test for #4645.
|
|
#
|
|
# @TEST-EXEC: zeek -b -r $TRACES/icmp/icmp-destunreach-ip.pcap %INPUT
|
|
# @TEST-EXEC: zeek -b -r $TRACES/icmp/icmp-destunreach-no-context.pcap %INPUT
|
|
# @TEST-EXEC: zeek -b -r $TRACES/icmp/icmp-destunreach-udp.pcap %INPUT
|
|
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
assert connection_exists(c$id), fmt("%s does not exist (pcap %s)", c$id, split_string(packet_source()$path, /\//)[-1]);
|
|
}
|