Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'security/topic/awelzel/125-ftp-timeout-three'

Browse source 
* security/topic/awelzel/125-ftp-timeout-three:
  testing/ftp: Add tests and pcaps with invalid reply lines
  ftp: Harden reply handing a bit and don't raise bad replies to script-land
  ftp: ignore invalid commands
This commit is contained in:
Tim Wojtulewicz 2023-02-01 10:47:21 -07:00
commit 9a0dc30e35
18 changed files with 203 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/scripts/base/protocols/ftp/ftp-invalid-reply-code.zeek Normal file
View file

@ -0,0 +1,11 @@
# @TEST-DOC: Th server replies with a line that does not contain a numeric code.: violation.
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ftp-invalid-reply-code.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff dpd.log
# @TEST-EXEC: test ! -f reporter.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "USER", "PASS", "SYST", "QUIT" };

11
testing/btest/scripts/base/protocols/ftp/ftp-missing-reply-code.zeek Normal file
View file

@ -0,0 +1,11 @@
# @TEST-DOC: Th server replies with a line that does not contain a numeric code.: violation.
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ftp-missing-reply-code.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff dpd.log
# @TEST-EXEC: test ! -f reporter.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "USER", "PASS", "SYST", "QUIT" };

11
testing/btest/scripts/base/protocols/ftp/ftp-missing-space-after-reply-code.zeek Normal file
View file

@ -0,0 +1,11 @@
# @TEST-DOC: Th server replies with a line that does not contain a numeric code.: violation.
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ftp-missing-space-after-reply-code.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff dpd.log
# @TEST-EXEC: test ! -f reporter.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "USER", "PASS", "SYST", "QUIT" };