mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 23:58:20 +00:00
f4101b5265
- flow_weird event with name argument value of "routing0_hdr" is raised for packets containing an IPv6 routing type 0 header because this type of header is now deprecated according to RFC 5095. - packets with a routing type 0 header and non-zero segments left now use the last address in that header in order to associate with a connection/flow and for calculating TCP/UDP checksums. - added a set of IPv4/IPv6 TCP/UDP checksum unit tests
10 lines
335 B
Text
10 lines
335 B
Text
# @TEST-EXEC: bro -b -r $TRACES/ipv6-hbh-routing0.trace %INPUT >output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
event ipv6_ext_headers(c: connection, p: pkt_hdr)
|
|
{
|
|
for ( h in p$ip6$exts )
|
|
if ( p$ip6$exts[h]$id == IPPROTO_ROUTING )
|
|
if ( p$ip6$exts[h]$routing$rtype == 0 )
|
|
print routing0_data_to_addrs(p$ip6$exts[h]$routing$data);
|
|
}
|