mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
51bad73e1e
- Add more guards against trying to analyze captured packets with a truncated IPv6 static header or extension header chain. - Add back in the ICMP payload tracking for ICMP "connections". - Fix 'icmp_context' record construction. Some field assignments were mismatched for ICMP and ICMP6. Source and destination addresses were set incorrectly for context packets that don't contain a full IP header. Some fields for ICMP6 weren't filled out. - Changed ICMP Time Exceeded packets to raise the 'icmp_time_exceeded' event instead of 'icmp_error_message'. - Add unit tests for truncation and the main types of ICMP/ICMP6 that have specific events. - Documentation clarifications.
92 lines
1.8 KiB
Text
92 lines
1.8 KiB
Text
# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace discarder-ip.bro >output
|
|
# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace discarder-tcp.bro >>output
|
|
# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace discarder-udp.bro >>output
|
|
# @TEST-EXEC: bro -C -r $TRACES/icmp/icmp-destunreach-udp.pcap discarder-icmp.bro >>output
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
@TEST-START-FILE discarder-ip.bro
|
|
|
|
event bro_init()
|
|
{
|
|
print "################ IP Discarder ################";
|
|
}
|
|
|
|
function discarder_check_ip(p: pkt_hdr): bool
|
|
{
|
|
if ( p?$ip && p$ip$src == 141.142.220.118 && p$ip$dst == 208.80.152.2 )
|
|
return F;
|
|
return T;
|
|
}
|
|
|
|
|
|
event new_packet(c: connection, p: pkt_hdr)
|
|
{
|
|
print c$id;
|
|
}
|
|
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE discarder-tcp.bro
|
|
|
|
event bro_init()
|
|
{
|
|
print "################ TCP Discarder ################";
|
|
}
|
|
|
|
function discarder_check_tcp(p: pkt_hdr, d: string): bool
|
|
{
|
|
if ( p$tcp$flags == TH_SYN )
|
|
return F;
|
|
return T;
|
|
}
|
|
|
|
event new_packet(c: connection, p: pkt_hdr)
|
|
{
|
|
if ( p?$tcp )
|
|
print c$id;
|
|
}
|
|
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE discarder-udp.bro
|
|
|
|
event bro_init()
|
|
{
|
|
print "################ UDP Discarder ################";
|
|
}
|
|
|
|
function discarder_check_udp(p: pkt_hdr, d: string): bool
|
|
{
|
|
if ( p?$ip6 )
|
|
return F;
|
|
return T;
|
|
}
|
|
|
|
event new_packet(c: connection, p: pkt_hdr)
|
|
{
|
|
if ( p?$udp )
|
|
print c$id;
|
|
}
|
|
|
|
@TEST-END-FILE
|
|
|
|
@TEST-START-FILE discarder-icmp.bro
|
|
|
|
event bro_init()
|
|
{
|
|
print "################ ICMP Discarder ################";
|
|
}
|
|
|
|
function discarder_check_icmp(p: pkt_hdr): bool
|
|
{
|
|
print fmt("Discard icmp packet: %s", p$icmp);
|
|
return T;
|
|
}
|
|
|
|
event new_packet(c: connection, p: pkt_hdr)
|
|
{
|
|
if ( p?$icmp )
|
|
print c$id;
|
|
}
|
|
|
|
@TEST-END-FILE
|