mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
e835a55229
- "src-ip" and "dst-ip" conditions can now use IPv6 addresses/subnets. They must be written in colon-hexadecimal representation and enclosed in square brackets (e.g. [fe80::1]). Addresses #774. - "icmp6" is now a valid protocol for use with "ip-proto" and "header" conditions. This allows signatures to be written that can match against ICMPv6 payloads. Addresses #880. - "ip6" is now a valid protocol for use with the "header" condition. (also the "ip-proto" condition, but it results in a no-op in that case since signatures apply only to the inner-most IP packet when packets are tunneled). This allows signatures to match specifically against IPv6 packets (whereas "ip" only matches against IPv4 packets). - "ip-proto" conditions can now match against IPv6 packets. Before, IPv6 packets were just silently ignored which meant DPD based on signatures did not function for IPv6 -- protocol analyzers would only get attached to a connection over IPv6 based on the well-known ports set in the "dpd_config" table.
71 lines
2.1 KiB
Text
71 lines
2.1 KiB
Text
# @TEST-EXEC: bro -b -s src-ip-eq -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-eq.out
|
|
# @TEST-EXEC: bro -b -s src-ip-eq-nomatch -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-eq-nomatch.out
|
|
# @TEST-EXEC: bro -b -s src-ip-eq-list -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-eq-list.out
|
|
|
|
# @TEST-EXEC: bro -b -s src-ip-ne -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-ne.out
|
|
# @TEST-EXEC: bro -b -s src-ip-ne-nomatch -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-ne-nomatch.out
|
|
# @TEST-EXEC: bro -b -s src-ip-ne-list -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-ne-list.out
|
|
# @TEST-EXEC: bro -b -s src-ip-ne-list-nomatch -r $TRACES/chksums/ip4-icmp-good-chksum.pcap %INPUT >src-ip-ne-list-nomatch.out
|
|
|
|
# @TEST-EXEC: btest-diff src-ip-eq.out
|
|
# @TEST-EXEC: btest-diff src-ip-eq-nomatch.out
|
|
# @TEST-EXEC: btest-diff src-ip-eq-list.out
|
|
|
|
# @TEST-EXEC: btest-diff src-ip-ne.out
|
|
# @TEST-EXEC: btest-diff src-ip-ne-nomatch.out
|
|
# @TEST-EXEC: btest-diff src-ip-ne-list.out
|
|
# @TEST-EXEC: btest-diff src-ip-ne-list-nomatch.out
|
|
|
|
@TEST-START-FILE src-ip-eq.sig
|
|
signature id {
|
|
src-ip == 192.168.1.0/24
|
|
event "src-ip-eq"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE src-ip-eq-nomatch.sig
|
|
signature id {
|
|
src-ip == 10.0.0.0/8
|
|
event "src-ip-eq-nomatch"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE src-ip-eq-list.sig
|
|
signature id {
|
|
src-ip == 10.0.0.0/8,[fe80::0]/16,192.168.1.0/24
|
|
event "src-ip-eq-list"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE src-ip-ne.sig
|
|
signature id {
|
|
src-ip != 10.0.0.0/8
|
|
event "src-ip-ne"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE src-ip-ne-nomatch.sig
|
|
signature id {
|
|
src-ip != 192.168.1.0/24
|
|
event "src-ip-ne-nomatch"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE src-ip-ne-list.sig
|
|
signature id {
|
|
src-ip != 10.0.0.0/8,[fe80::0]/16
|
|
event "src-ip-ne-list"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE src-ip-ne-list-nomatch.sig
|
|
signature id {
|
|
src-ip != 10.0.0.0/8,[fe80::0]/16,192.168.1.0/24
|
|
event "src-ip-ne-list-nomatch"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
event signature_match(state: signature_state, msg: string, data: string)
|
|
{
|
|
print fmt("signature_match %s - %s", state$conn$id, msg);
|
|
}
|