mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
cb679e4d7a
This wasn't possible before #3028 was fixed, but now it's safe to set the value in new_connection() and allow other users access to the field much earlier. We do not have to deal with connection_flipped() because the community-id hash is symmetric.
13 lines
474 B
Text
13 lines
474 B
Text
# @TEST-DOC: Ensure community_id is logged even if the connection is flipped.
|
|
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tcp/handshake-reorder.trace %INPUT >out
|
|
# @TEST-EXEC: zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p proto service community_id < conn.log > conn.log.cut
|
|
# @TEST-EXEC: btest-diff out
|
|
# @TEST-EXEC: btest-diff conn.log.cut
|
|
|
|
@load protocols/conn/community-id-logging
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
print "new_connection", c$uid, c$conn$community_id;
|
|
}
|