mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
1fed0ed58d
This changes the PPPoE parser so that it doesn't forward extra bytes that might be appended after the payload. Instead, it raises a weird if the payload size doesn't match the size indicated by the header. This is in line with what other protocol parsers (like UDP) are doing. Two tests needed to be updated - with this change, the traffic in pppoe-over-qinq.pcap is now valid TLS. A new trace was introduced for the confirmation-violation-info test. Addresses GH-4602
14 lines
554 B
Text
14 lines
554 B
Text
# @TEST-DOC: The SSL analyzer picks up on the traffic, but then raises analyzer_violation_info
|
|
# @TEST-REQUIRES: ! have-spicy-ssl
|
|
# @TEST-EXEC: zeek -r $TRACES/tls/tls-1.2-protocol-error.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
event analyzer_confirmation_info(tag: AllAnalyzers::Tag, info: AnalyzerConfirmationInfo)
|
|
{
|
|
print "analyzer_confirmation_info", tag, info$c$id, info$aid;
|
|
}
|
|
|
|
event analyzer_violation_info(tag: AllAnalyzers::Tag, info: AnalyzerViolationInfo)
|
|
{
|
|
print "analyzer_violation_info", tag, info$reason, info$c$id, info$aid;
|
|
}
|