mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 05:58:20 +00:00
3a320fc6b6
There's a logic error in the packet analyzer's AnalyzerConfirmation() method that causes analyzer_confirmation() events to be raised for every packet rather than stopping after the first confirmation which appears to have been the intention. This affects, for example, VXLAN and Geneve tunnels. The optional arg_tag parameter was used for short-circuit'ing, but the return value of GetAnalyzerTag() used for setting the session state causing the disconnect. In scenarios where Zeek receives purely tunneled monitoring traffic, this may result in a non-negligible performance impact. Somewhat related, ensure the session state is set to violated before short-circuiting if no analyzer_violations are installed. Suggesting this as a 5.0.3 candidate.
19 lines
674 B
Text
19 lines
674 B
Text
# @TEST-DOC: Check how many analyzer_confirmation events a vxlan-encapsulated HTTP transaction triggers. Should be 2.
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tunnels/vxlan-encapsulated-http.pcap %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
# @TEST-EXEC: btest-diff conn.log
|
|
# @TEST-EXEC: btest-diff http.log
|
|
|
|
@load base/frameworks/tunnels
|
|
@load base/protocols/conn
|
|
@load base/protocols/http
|
|
|
|
event analyzer_confirmation(c: connection, atype: AllAnalyzers::Tag, aid: count)
|
|
{
|
|
print "analyzer_confirmation", c$uid, c$id, aid;
|
|
}
|
|
|
|
event analyzer_violation(c: connection, atype: AllAnalyzers::Tag, aid: count, reason: string)
|
|
{
|
|
print "analyzer_violation", c$uid, c$id, aid, reason;
|
|
}
|