Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/3936-pop3-and-redis'

Browse source 
* origin/topic/awelzel/3936-pop3-and-redis:
  pop3: Remove unused headers
  pop3: Prevent unbounded state growth
  btest/pop3: Add somewhat more elaborate testing

(cherry picked from commit 702fb031a4)
This commit is contained in:
Tim Wojtulewicz 2024-09-23 10:59:51 -07:00
parent 2ec7e59771
commit 9503d3298d
22 changed files with 256 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

27
CHANGES
View file

@ -1,3 +1,30 @@
6.0.6-1 | 2024-09-23 12:45:07 -0700
* pop3: Remove unused headers (Arne Welzel, Corelight)
(cherry picked from commit 702fb031a4ea2b00364d6a7321384a45551ce3a2)
* pop3: Prevent unbounded state growth (Arne Welzel, Corelight)
The cmds list may grow unbounded due to the POP3 analyzer being in
multiLine mode after seeing `AUTH` in a Redis connection, but never
a `.` terminator. This can easily be provoked by the Redis ping
command.
This adds two heuristics: 1) Forcefully process the oldest commands in
the cmds list and cap it at max_pending_commands. 2) Start raising
analyzer violations if the client has been using more than
max_unknown_client_commands commands (default 10).
(cherry picked from commit 702fb031a4ea2b00364d6a7321384a45551ce3a2)
* btest/pop3: Add somewhat more elaborate testing (Arne Welzel, Corelight)
PCAP taken from here: https://tranalyzer.com/tutorial/pop and reference
added to Traces/README.
(cherry picked from commit 702fb031a4ea2b00364d6a7321384a45551ce3a2)
6.0.6 | 2024-09-03 14:46:02 -0700 6.0.6 | 2024-09-03 14:46:02 -0700
* CI: Fix centos-7 Dockerfile to replace obsolete yum repos (Tim Wojtulewicz) * CI: Fix centos-7 Dockerfile to replace obsolete yum repos (Tim Wojtulewicz)

2
VERSION
View file

@ -1 +1 @@
6.0.6 6.0.6-1

16
scripts/base/init-bare.zeek
View file

@ -2793,6 +2793,22 @@ export {
} # end export } # end export
module POP3;
export {
## How many commands a POP3 client may have pending
## before Zeek forcefully removes the oldest.
##
## Setting this value to 0 removes the limit.
const max_pending_commands = 10 &redef;
## How many invalid commands a POP3 client may use
## before Zeek starts raising analyzer violations.
##
## Setting this value to 0 removes the limit.
const max_unknown_client_commands = 10 &redef;
} # end export
module Threading; module Threading;

1
src/analyzer/protocol/pop3/CMakeLists.txt
View file

@ -5,4 +5,5 @@ zeek_add_plugin(
POP3.cc POP3.cc
Plugin.cc Plugin.cc
BIFS BIFS
consts.bif
events.bif) events.bif)

41
src/analyzer/protocol/pop3/POP3.cc
View file

@ -3,8 +3,6 @@
#include "zeek/analyzer/protocol/pop3/POP3.h" #include "zeek/analyzer/protocol/pop3/POP3.h"
#include "zeek/zeek-config.h"
#include <cctype> #include <cctype>
#include <string> #include <string>
#include <vector> #include <vector>
@ -12,6 +10,7 @@
#include "zeek/Base64.h" #include "zeek/Base64.h"
#include "zeek/Reporter.h" #include "zeek/Reporter.h"
#include "zeek/analyzer/Manager.h" #include "zeek/analyzer/Manager.h"
#include "zeek/analyzer/protocol/pop3/consts.bif.h"
#include "zeek/analyzer/protocol/pop3/events.bif.h" #include "zeek/analyzer/protocol/pop3/events.bif.h"
namespace zeek::analyzer::pop3 namespace zeek::analyzer::pop3
@ -44,6 +43,7 @@ POP3_Analyzer::POP3_Analyzer(Connection* conn)
authLines = 0; authLines = 0;
mail = nullptr; mail = nullptr;
unknown_client_cmds = 0;
cl_orig = new analyzer::tcp::ContentLine_Analyzer(conn, true); cl_orig = new analyzer::tcp::ContentLine_Analyzer(conn, true);
AddSupportAnalyzer(cl_orig); AddSupportAnalyzer(cl_orig);
@ -226,6 +226,23 @@ void POP3_Analyzer::ProcessRequest(int length, const char* line)
// keep a list of pending commands. // keep a list of pending commands.
cmds.push_back(std::string(line)); cmds.push_back(std::string(line));
// Prevent unbounded state growth of cmds if there are no matching
// server replies by just processing commands even if we didn't see
// the server response.
//
// This may be caused by packet drops, one-sided traffic, analyzing
// the wrong protocol (Redis), etc.
if ( zeek::BifConst::POP3::max_pending_commands > 0 )
{
if ( cmds.size() > zeek::BifConst::POP3::max_pending_commands )
{
Weird("pop3_client_too_many_pending_commands");
ProcessClientCmd();
cmds.pop_front();
}
}
if ( cmds.size() == 1 ) if ( cmds.size() == 1 )
// Not waiting for another server response, // Not waiting for another server response,
// so we can process it immediately. // so we can process it immediately.
@ -261,10 +278,20 @@ void POP3_Analyzer::ProcessClientCmd()
{ {
if ( ! waitingForAuthentication ) if ( ! waitingForAuthentication )
{ {
Weird("pop3_client_command_unknown"); Weird("pop3_client_command_unknown", (tokens.size() > 0 ? tokens[0].c_str() : "???"));
if ( subState == detail::POP3_WOK ) if ( subState == detail::POP3_WOK )
subState = detail::POP3_OK; subState = detail::POP3_OK;
++unknown_client_cmds;
if ( zeek::BifConst::POP3::max_unknown_client_commands > 0 )
{
if ( unknown_client_cmds > zeek::BifConst::POP3::max_unknown_client_commands )
{
AnalyzerViolation("too many unknown client commands");
}
}
} }
return; return;
} }
@ -333,6 +360,7 @@ void POP3_Analyzer::ProcessClientCmd()
POP3Event(pop3_request, true, cmd, message); POP3Event(pop3_request, true, cmd, message);
if ( ! *message ) if ( ! *message )
{ {
// This is the client requesting a list of AUTH mechanisms available.
requestForMultiLine = true; requestForMultiLine = true;
state = detail::AUTH; state = detail::AUTH;
subState = detail::POP3_WOK; subState = detail::POP3_WOK;
@ -629,10 +657,15 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
(tokens.size() > 0 ? tokens[0].c_str() : "???")), (tokens.size() > 0 ? tokens[0].c_str() : "???")),
line, length); line, length);
Weird("pop3_server_command_unknown"); Weird("pop3_server_command_unknown", (tokens.size() > 0 ? tokens[0].c_str() : "???"));
if ( subState == detail::POP3_WOK ) if ( subState == detail::POP3_WOK )
subState = detail::POP3_OK; subState = detail::POP3_OK;
// If we're not in state AUTH and receive "some" response,
// assume it was for the last command from the client.
FinishClientCmd();
} }
return; return;
} }

8
src/analyzer/protocol/pop3/POP3.h
View file

@ -4,11 +4,9 @@
#pragma once #pragma once
#include <algorithm>
#include <string> #include <string>
#include <vector> #include <vector>
#include "zeek/analyzer/protocol/login/NVT.h"
#include "zeek/analyzer/protocol/mime/MIME.h" #include "zeek/analyzer/protocol/mime/MIME.h"
#include "zeek/analyzer/protocol/tcp/ContentLine.h" #include "zeek/analyzer/protocol/tcp/ContentLine.h"
#include "zeek/analyzer/protocol/tcp/TCP.h" #include "zeek/analyzer/protocol/tcp/TCP.h"
@ -79,7 +77,10 @@ public:
void Done() override; void Done() override;
void DeliverStream(int len, const u_char* data, bool orig) override; void DeliverStream(int len, const u_char* data, bool orig) override;
static analyzer::Analyzer* Instantiate(Connection* conn) { return new POP3_Analyzer(conn); } static analyzer::Analyzer* Instantiate(Connection* conn)
{
return new POP3_Analyzer(conn);
}
protected: protected:
int masterState; int masterState;
@ -114,6 +115,7 @@ protected:
analyzer::mime::MIME_Mail* mail; analyzer::mime::MIME_Mail* mail;
std::list<std::string> cmds; std::list<std::string> cmds;
zeek_uint_t unknown_client_cmds;
private: private:
bool tls; bool tls;

2
src/analyzer/protocol/pop3/consts.bif Normal file
View file

@ -0,0 +1,2 @@
const POP3::max_pending_commands: count;
const POP3::max_unknown_client_commands: count;

2
testing/btest/Baseline/core.max-analyzer-violations/weird.log
View file

@ -7,7 +7,7 @@
#open XXXX-XX-XX-XX-XX-XX #open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string #types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58246 127.0.0.1 110 pop3_server_command_unknown - F zeek POP3 XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58246 127.0.0.1 110 pop3_server_command_unknown + F zeek POP3
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58246 127.0.0.1 110 line_terminated_with_single_CR - F zeek CONTENTLINE XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58246 127.0.0.1 110 line_terminated_with_single_CR - F zeek CONTENTLINE
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58246 127.0.0.1 110 too_many_analyzer_violations - F zeek POP3 XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58246 127.0.0.1 110 too_many_analyzer_violations - F zeek POP3
#close XXXX-XX-XX-XX-XX-XX #close XXXX-XX-XX-XX-XX-XX

1
testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
View file

@ -187,6 +187,7 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/plugins/Zeek_NTLM.events.bif.zeek build/scripts/base/bif/plugins/Zeek_NTLM.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_NTP.types.bif.zeek build/scripts/base/bif/plugins/Zeek_NTP.types.bif.zeek
build/scripts/base/bif/plugins/Zeek_NTP.events.bif.zeek build/scripts/base/bif/plugins/Zeek_NTP.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_POP3.consts.bif.zeek
build/scripts/base/bif/plugins/Zeek_POP3.events.bif.zeek build/scripts/base/bif/plugins/Zeek_POP3.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_RADIUS.events.bif.zeek build/scripts/base/bif/plugins/Zeek_RADIUS.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_RDP.events.bif.zeek build/scripts/base/bif/plugins/Zeek_RDP.events.bif.zeek

1
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -187,6 +187,7 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/plugins/Zeek_NTLM.events.bif.zeek build/scripts/base/bif/plugins/Zeek_NTLM.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_NTP.types.bif.zeek build/scripts/base/bif/plugins/Zeek_NTP.types.bif.zeek
build/scripts/base/bif/plugins/Zeek_NTP.events.bif.zeek build/scripts/base/bif/plugins/Zeek_NTP.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_POP3.consts.bif.zeek
build/scripts/base/bif/plugins/Zeek_POP3.events.bif.zeek build/scripts/base/bif/plugins/Zeek_POP3.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_RADIUS.events.bif.zeek build/scripts/base/bif/plugins/Zeek_RADIUS.events.bif.zeek
build/scripts/base/bif/plugins/Zeek_RDP.events.bif.zeek build/scripts/base/bif/plugins/Zeek_RDP.events.bif.zeek

6
testing/btest/Baseline/plugins.hooks/output
View file

@ -894,6 +894,7 @@
0.000000 MetaHookPost LoadFile(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_POP3.consts.bif.zeek, <...>/Zeek_POP3.consts.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek) -> -1
@ -1285,6 +1286,7 @@
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek) -> (-1, <no content>) 0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek) -> (-1, <no content>) 0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek) -> (-1, <no content>) 0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_POP3.consts.bif.zeek, <...>/Zeek_POP3.consts.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek) -> (-1, <no content>) 0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek) -> (-1, <no content>) 0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek) -> (-1, <no content>)
0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek) -> (-1, <no content>) 0.000000 MetaHookPost LoadFileExtended(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek) -> (-1, <no content>)
@ -2519,6 +2521,7 @@
0.000000 MetaHookPre LoadFile(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_POP3.consts.bif.zeek, <...>/Zeek_POP3.consts.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek)
0.000000 MetaHookPre LoadFile(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek)
@ -2910,6 +2913,7 @@
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek) 0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_NetBIOS.functions.bif.zeek, <...>/Zeek_NetBIOS.functions.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek) 0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_NoneWriter.none.bif.zeek, <...>/Zeek_NoneWriter.none.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek) 0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_PE.events.bif.zeek, <...>/Zeek_PE.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_POP3.consts.bif.zeek, <...>/Zeek_POP3.consts.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek) 0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_POP3.events.bif.zeek, <...>/Zeek_POP3.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek) 0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_RADIUS.events.bif.zeek, <...>/Zeek_RADIUS.events.bif.zeek)
0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek) 0.000000 MetaHookPre LoadFileExtended(0, ./Zeek_RDP.events.bif.zeek, <...>/Zeek_RDP.events.bif.zeek)
@ -4143,6 +4147,7 @@
0.000000 | HookLoadFile ./Zeek_NetBIOS.functions.bif.zeek <...>/Zeek_NetBIOS.functions.bif.zeek 0.000000 | HookLoadFile ./Zeek_NetBIOS.functions.bif.zeek <...>/Zeek_NetBIOS.functions.bif.zeek
0.000000 | HookLoadFile ./Zeek_NoneWriter.none.bif.zeek <...>/Zeek_NoneWriter.none.bif.zeek 0.000000 | HookLoadFile ./Zeek_NoneWriter.none.bif.zeek <...>/Zeek_NoneWriter.none.bif.zeek
0.000000 | HookLoadFile ./Zeek_PE.events.bif.zeek <...>/Zeek_PE.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_PE.events.bif.zeek <...>/Zeek_PE.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_POP3.consts.bif.zeek <...>/Zeek_POP3.consts.bif.zeek
0.000000 | HookLoadFile ./Zeek_POP3.events.bif.zeek <...>/Zeek_POP3.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_POP3.events.bif.zeek <...>/Zeek_POP3.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_RADIUS.events.bif.zeek <...>/Zeek_RADIUS.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_RADIUS.events.bif.zeek <...>/Zeek_RADIUS.events.bif.zeek
0.000000 | HookLoadFile ./Zeek_RDP.events.bif.zeek <...>/Zeek_RDP.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_RDP.events.bif.zeek <...>/Zeek_RDP.events.bif.zeek
@ -4534,6 +4539,7 @@
0.000000 | HookLoadFileExtended ./Zeek_NetBIOS.functions.bif.zeek <...>/Zeek_NetBIOS.functions.bif.zeek 0.000000 | HookLoadFileExtended ./Zeek_NetBIOS.functions.bif.zeek <...>/Zeek_NetBIOS.functions.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_NoneWriter.none.bif.zeek <...>/Zeek_NoneWriter.none.bif.zeek 0.000000 | HookLoadFileExtended ./Zeek_NoneWriter.none.bif.zeek <...>/Zeek_NoneWriter.none.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_PE.events.bif.zeek <...>/Zeek_PE.events.bif.zeek 0.000000 | HookLoadFileExtended ./Zeek_PE.events.bif.zeek <...>/Zeek_PE.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_POP3.consts.bif.zeek <...>/Zeek_POP3.consts.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_POP3.events.bif.zeek <...>/Zeek_POP3.events.bif.zeek 0.000000 | HookLoadFileExtended ./Zeek_POP3.events.bif.zeek <...>/Zeek_POP3.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_RADIUS.events.bif.zeek <...>/Zeek_RADIUS.events.bif.zeek 0.000000 | HookLoadFileExtended ./Zeek_RADIUS.events.bif.zeek <...>/Zeek_RADIUS.events.bif.zeek
0.000000 | HookLoadFileExtended ./Zeek_RDP.events.bif.zeek <...>/Zeek_RDP.events.bif.zeek 0.000000 | HookLoadFileExtended ./Zeek_RDP.events.bif.zeek <...>/Zeek_RDP.events.bif.zeek

21
testing/btest/Baseline/scripts.base.protocols.pop3.basic/conn.log Normal file
View file

@ -0,0 +1,21 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.0.4 26242 212.227.15.188 110 tcp - 0.050692 0 0 REJ T F 0 Sr 1 52 1 40 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.0.4 26242 212.227.15.188 110 tcp - 0.060847 0 0 REJ T F 0 Sr 1 52 1 40 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.0.4 26245 212.227.15.171 110 tcp - 0.050705 0 0 REJ T F 0 Sr 1 52 1 40 -
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.0.4 26245 212.227.15.171 110 tcp - 0.050062 0 0 REJ T F 0 Sr 1 52 1 40 -
XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.0.4 26242 212.227.15.188 110 tcp - 0.050967 0 0 REJ T F 0 Sr 1 48 1 40 -
XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.0.4 26245 212.227.15.171 110 tcp - 0.047718 0 0 REJ T F 0 Sr 1 48 1 40 -
XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.0.4 26272 212.227.15.166 110 tcp pop3 0.163506 12 175 SF T F 0 ShAdDafF 6 264 6 427 -
XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.0.4 26284 212.227.15.166 110 tcp pop3 3.469839 86 205 SF T F 0 ShAdDafF 9 470 9 577 -
XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.0.4 26304 212.227.15.166 110 tcp pop3 0.206558 12 175 SF T F 0 ShAdDafF 6 264 6 427 -
XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.0.4 26308 212.227.15.166 110 tcp pop3 0.537230 96 297 SF T F 0 ShAdDafF 9 468 10 709 -
XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.0.4 26383 212.227.15.166 110 tcp pop3 1.213485 138 19651 SF T F 0 ShAdDafF 22 1030 30 20863 -
#close XXXX-XX-XX-XX-XX-XX

48
testing/btest/Baseline/scripts.base.protocols.pop3.basic/out Normal file
View file

@ -0,0 +1,48 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
CP5puj4I8PtEU4qzYg, pop3_reply, F, OK, POP server ready H mimap4 0MHoUr-1VDxRD3Ui5-003eq2
CP5puj4I8PtEU4qzYg, pop3_request, T, CAPA,
CP5puj4I8PtEU4qzYg, pop3_reply, F, OK, Capability list follows
CP5puj4I8PtEU4qzYg, pop3_request, T, QUIT,
CP5puj4I8PtEU4qzYg, pop3_reply, F, OK, POP server signing off
C37jN32gN3y3AZzyf6, pop3_reply, F, OK, POP server ready H mimap8 0MHXFQ-1VDgSF1308-003NYq
C37jN32gN3y3AZzyf6, pop3_request, T, AUTH,
C37jN32gN3y3AZzyf6, pop3_reply, F, ERR, 1 argument required
C37jN32gN3y3AZzyf6, pop3_request, T, CAPA,
C37jN32gN3y3AZzyf6, pop3_reply, F, OK, Capability list follows
C37jN32gN3y3AZzyf6, pop3_request, T, AUTH, PLAIN
C37jN32gN3y3AZzyf6, pop3_reply, F, ERR, authentication failed
C3eiCBGOLw3VtHfOj, pop3_reply, F, OK, POP server ready H mimap9 0MK0or-1VBlin3ixZ-001RVN
C3eiCBGOLw3VtHfOj, pop3_request, T, CAPA,
C3eiCBGOLw3VtHfOj, pop3_reply, F, OK, Capability list follows
C3eiCBGOLw3VtHfOj, pop3_request, T, QUIT,
C3eiCBGOLw3VtHfOj, pop3_reply, F, OK, POP server signing off
CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, POP server ready H mimap13 0MW5rZ-1VayeZ2jFp-00XVZd
CwjjYJ2WqgTbAqiHl6, pop3_request, T, AUTH,
CwjjYJ2WqgTbAqiHl6, pop3_reply, F, ERR, 1 argument required
CwjjYJ2WqgTbAqiHl6, pop3_request, T, CAPA,
CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, Capability list follows
CwjjYJ2WqgTbAqiHl6, pop3_request, T, AUTH, PLAIN
CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, mailbox "digitalinvestigator@networksims.com" has 3 messages (19191 octets) H mimap13
CwjjYJ2WqgTbAqiHl6, pop3_request, T, QUIT,
CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, POP server signing off
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, POP server ready H mimap15 0LfD5x-1VsVU4327M-00pHSn
C0LAHyvtKSQHyJxIl, pop3_request, T, AUTH,
C0LAHyvtKSQHyJxIl, pop3_reply, F, ERR, 1 argument required
C0LAHyvtKSQHyJxIl, pop3_request, T, CAPA,
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, Capability list follows
C0LAHyvtKSQHyJxIl, pop3_request, T, AUTH, PLAIN
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, mailbox "digitalinvestigator@networksims.com" has 3 messages (19191 octets) H mimap15
C0LAHyvtKSQHyJxIl, pop3_request, T, STAT,
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, 3 19191
C0LAHyvtKSQHyJxIl, pop3_request, T, LIST,
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK,
C0LAHyvtKSQHyJxIl, pop3_request, T, UIDL,
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK,
C0LAHyvtKSQHyJxIl, pop3_request, T, RETR, 1
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK,
C0LAHyvtKSQHyJxIl, pop3_request, T, RETR, 2
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK,
C0LAHyvtKSQHyJxIl, pop3_request, T, RETR, 3
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK,
C0LAHyvtKSQHyJxIl, pop3_request, T, QUIT,
C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, POP server signing off

16
testing/btest/Baseline/scripts.base.protocols.pop3.redis/analyzer.log Normal file
View file

@ -0,0 +1,16 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path analyzer
#open XXXX-XX-XX-XX-XX-XX
#fields ts cause analyzer_kind analyzer_name uid fuid id.orig_h id.orig_p id.resp_h id.resp_p failure_reason failure_data
#types time string string string string string addr port addr port string string
XXXXXXXXXX.XXXXXX violation protocol POP3 CHhAvVGS1DHFjwGM9 - 127.0.0.1 59954 127.0.0.1 6379 too many unknown client commands -
XXXXXXXXXX.XXXXXX violation protocol POP3 CHhAvVGS1DHFjwGM9 - 127.0.0.1 59954 127.0.0.1 6379 too many unknown client commands -
XXXXXXXXXX.XXXXXX violation protocol POP3 CHhAvVGS1DHFjwGM9 - 127.0.0.1 59954 127.0.0.1 6379 too many unknown client commands -
XXXXXXXXXX.XXXXXX violation protocol POP3 CHhAvVGS1DHFjwGM9 - 127.0.0.1 59954 127.0.0.1 6379 too many unknown client commands -
XXXXXXXXXX.XXXXXX violation protocol POP3 CHhAvVGS1DHFjwGM9 - 127.0.0.1 59954 127.0.0.1 6379 too many unknown client commands -
XXXXXXXXXX.XXXXXX violation protocol POP3 CHhAvVGS1DHFjwGM9 - 127.0.0.1 59954 127.0.0.1 6379 too many unknown client commands -
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.protocols.pop3.redis/conn.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 59954 127.0.0.1 6379 tcp - 0.002030 848 370 SF T T 0 ShADadfF 58 3872 58 3394 -
#close XXXX-XX-XX-XX-XX-XX

4
testing/btest/Baseline/scripts.base.protocols.pop3.redis/out Normal file
View file

@ -0,0 +1,4 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
CHhAvVGS1DHFjwGM9, pop3_reply, F, OK,
CHhAvVGS1DHFjwGM9, pop3_request, T, AUTH,
CHhAvVGS1DHFjwGM9, pop3_reply, F, OK,

12
testing/btest/Baseline/scripts.base.protocols.pop3.redis/weird.log Normal file
View file

@ -0,0 +1,12 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 59954 127.0.0.1 6379 pop3_client_command_unknown *2 F zeek POP3
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 59954 127.0.0.1 6379 pop3_client_too_many_pending_commands - F zeek POP3
#close XXXX-XX-XX-XX-XX-XX

6
testing/btest/Traces/README
View file

@ -3,3 +3,9 @@ These are the trace files that are used by the Zeek test suite.
Note to maintainers: please take care when modifying/removing files from here. Note to maintainers: please take care when modifying/removing files from here.
We install these traces with the Zeek distribution and external packages might We install these traces with the Zeek distribution and external packages might
depend on them for tests. depend on them for tests.
Trace Index/Sources:
- pop3/POP3.pcap: Picked up from POP tutorial on tranalyzer.com
https://tranalyzer.com/tutorial/pop
https://tranalyzer.com/download/data/pop3.pcap

BIN
testing/btest/Traces/pop3/pop3.pcap Normal file
View file

Binary file not shown.

BIN
testing/btest/Traces/pop3/redis-50-pings.pcap Normal file
View file

Binary file not shown.

20
testing/btest/scripts/base/protocols/pop3/basic.zeek Normal file
View file

@ -0,0 +1,20 @@
# @TEST-DOC: Ensure basic POP3 functionality.
# @TEST-EXEC: zeek -C -b -r $TRACES/pop3/pop3.pcap %INPUT >out
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: test ! -f weird.log
# @TEST-EXEC: test ! -f analyzer.log
@load base/frameworks/notice/weird
@load base/protocols/conn
@load base/protocols/pop3
event pop3_request(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_request", is_orig, cmd, arg;
}
event pop3_reply(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_reply", is_orig, cmd, arg;
}

20
testing/btest/scripts/base/protocols/pop3/redis.zeek Normal file
View file

@ -0,0 +1,20 @@
# @TEST-DOC: The POP3 signature triggered on Redis traffic. Ensure the analyzer is eventually removed to avoid.
# @TEST-EXEC: zeek -C -b -r $TRACES/pop3/redis-50-pings.pcap %INPUT >out
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: btest-diff analyzer.log
@load base/frameworks/notice/weird
@load base/protocols/conn
@load base/protocols/pop3
event pop3_request(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_request", is_orig, cmd, arg;
}
event pop3_reply(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_reply", is_orig, cmd, arg;
}