mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
af77a7a83b
The main part of this commit are changes in tests. A lot of the tests that previously relied on analyzer.log or dpd.log now use the new analyzer-failed.log. I verified all the changes and, as far as I can tell, everything behaves as it should. This includes the external test baselines. This change also enables logging of file and packet analyzer to analyzer_failed.log and fixes some small behavior issues. The analyzer_failed event is no longer raised when the removal of an analyzer is vetoed. If an analyzer is no longer active when an analyzer violation is raised, currently the analyzer_failed event is raised. This can, e.g., happen when an analyzer error happens at the very end of the connection. This makes the behavior more similar to what happened in the past, and also intuitively seems to make sense. A bug introduced in the failed service logging was fixed.
34 lines
1.1 KiB
Text
34 lines
1.1 KiB
Text
@deprecated("Please switch to frameworks/analyzer/packet-segment-logging, which logs to analyzer.log. Remove in 8.1")
|
|
|
|
##! This script enables logging of packet segment data when a protocol
|
|
##! parsing violation is encountered. The amount of data from the
|
|
##! packet logged is set by the :zeek:see:`DPD::packet_segment_size` variable.
|
|
##! A caveat to logging packet data is that in some cases, the packet may
|
|
##! not be the packet that actually caused the protocol violation.
|
|
|
|
@load frameworks/analyzer/dpd-log
|
|
|
|
module DPD;
|
|
|
|
export {
|
|
redef record Info += {
|
|
## A chunk of the payload that most likely resulted in the
|
|
## analyzer violation.
|
|
packet_segment: string &optional &log;
|
|
};
|
|
|
|
## Size of the packet segment to display in the DPD log.
|
|
option packet_segment_size: int = 255;
|
|
}
|
|
|
|
|
|
event analyzer_violation_info(atype: AllAnalyzers::Tag, info: AnalyzerViolationInfo) &priority=4
|
|
{
|
|
if ( ! is_protocol_analyzer(atype) && ! is_packet_analyzer(atype) )
|
|
return;
|
|
|
|
if ( ! info?$c || ! info$c?$dpd )
|
|
return;
|
|
|
|
info$c$dpd$packet_segment = fmt("%s", sub_bytes(get_current_packet()$data, 0, packet_segment_size));
|
|
}
|