Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

testing/ftp: Add tests and pcaps with invalid reply lines

Browse source 
These have been created artificially. The tests show that for an
invalid reply line without a numeric code, with a numeric code < 100
or a numeric code not followed by a space we now raise an analyzer
violation and disable the analyzer.
This commit is contained in:
Arne Welzel 2022-11-30 19:21:10 +01:00
parent cf375cf362
commit 942f829825
15 changed files with 138 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/scripts/base/protocols/ftp/ftp-missing-reply-code.zeek Normal file
View file

@ -0,0 +1,11 @@
# @TEST-DOC: Th server replies with a line that does not contain a numeric code.: violation.
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ftp-missing-reply-code.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff dpd.log
# @TEST-EXEC: test ! -f reporter.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "USER", "PASS", "SYST", "QUIT" };