mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
c72c1cba6f
This commit revamps the handling of analyzer violations that happen
before an analyzer confirms the protocol.
The current state is that an analyzer is disabled after 5 violations, if
it has not been confirmed. If it has been confirmed, it is disabled
after a single violation.
The reason for this is a historic mistake. In Zeek up to versions 1.5,
analyzers were unconditianally removed when they raised the first
protocol violation.
When this script was ported to the new layout for Zeek 2.0 in
b4b990cfb5, a logic error was introduced
that caused analyzers to no longer be disabled if they were not
confirmed.
This was the state for ~8 years, till the DPD::max_violations options
was added, which instates the current approach of disabling unconfirmed
analyzers after 5 violations. Sadly, there is not much discussion about
this change - from my hazy memory, I think this was discovered during
performance tests and the new behavior was added without checking into
the history of previous changes.
This commit reinstates the originally intended behavior of DPD. When an
analyzer that has not been confirmed raises a protocol violation, it is
immediately removed from the connection. This also makes a lot of sense
- this allows the analyzer to be in a "tasting" phase at the beginning
of the connection, and to error out quickly once it realizes that it was
attached to a connection not containing the desired protocol.
This change also removes the DPD::max_violations option, as it no longer
serves any purpose after this change. (In practice, the option remains
with an &deprecated warning, but it is no longer used for anything).
There are relatively minimal test-baseline changes due to this; they are
mostly triggered by the removal of the data structure and by less
analyzer errors being thrown, as unconfirmed analyzers are disabled
after the first error.
30 lines
3.9 KiB
Text
30 lines
3.9 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path analyzer
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts cause analyzer_kind analyzer_name uid fuid id.orig_h id.orig_p id.resp_h id.resp_p failure_reason failure_data
|
|
#types time string string string string string addr port addr port string string
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CHhAvVGS1DHFjwGM9 - 192.168.1.79 51880 131.159.21.1 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH ClEkJM2Vm5giqnMf4h - 192.168.2.1 57189 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C4J4Th3PJpwUYZZ6gc - 192.168.2.1 57191 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CtPZjS20MLrsMUOJi2 - 192.168.2.1 56594 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CUM0KZ3MLUfNB0cl11 - 192.168.2.1 56821 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CmES5u32sYpV7JYN - 192.168.2.1 56837 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CP5puj4I8PtEU4qzYg - 192.168.2.1 56845 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C37jN32gN3y3AZzyf6 - 192.168.2.1 56875 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C3eiCBGOLw3VtHfOj - 192.168.2.1 56878 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CwjjYJ2WqgTbAqiHl6 - 192.168.2.1 56940 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C0LAHyvtKSQHyJxIl - 192.168.2.1 57831 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CFLRIC3zaTU1loLGxh - 192.168.2.1 59246 192.168.2.158 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C9rXSW3KSpTYvPrlI1 - 192.168.1.32 41164 128.2.10.238 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH Ck51lg1bScffFj34Ri - 192.168.1.32 33910 128.2.13.133 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C9mvWx3ezztgzcexV7 - 192.168.1.32 41268 128.2.10.238 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CNnMIj2QSd84NKf7U3 - 192.168.1.31 52294 192.168.1.32 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH C7fIlMZDuRiqjpYbb - 192.168.1.31 51489 192.168.1.32 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CykQaM33ztNt0csB9a - 192.168.1.32 58641 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CtxTCR2Yer0FR1tIBg - 192.168.1.32 58646 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
XXXXXXXXXX.XXXXXX violation protocol SSH CpmdRlaUoJLN3uIRa - 192.168.1.32 58649 131.103.20.168 22 Binpac exception: binpac exception: invalid index for case: SSH_Key_Exchange: 3 -
|
|
#close XXXX-XX-XX-XX-XX-XX
|