Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

add a max_line_length flag to ContentLine_Analyzer

Browse source 
In ContentLine_Analyzer, prevent excessively long lines being assembled.
The line length will default to just under 16MB, but can be overriden on
a per-analyzer basis.  This is done for the finger,ident, and irc
analyzers.
This commit is contained in:
Justin Azoff 2017-11-03 16:13:18 -04:00
parent b6e3603481
commit 43b2b9806e
9 changed files with 40 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/scripts/base/protocols/irc/longline.test Normal file
View file

@ -0,0 +1,6 @@
# This tests that an excessively long line is truncated by the contentline
# analyzer
# @TEST-EXEC: bro -C -r $TRACES/contentline-irc-5k-line.pcap %INPUT
# @TEST-EXEC: btest-diff weird.log