mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
spicy-redis: Abort parsing if server data comes first
Redis seems to only want client data first to request server data. The DPD signature seems to pick up on some cases where server data comes first, but is otherwise "valid" RESP. See if this helps lower FP rates.
This commit is contained in:
parent
90d56ce630
commit
aef9fe11dc
4 changed files with 31 additions and 3 deletions
|
@ -0,0 +1,14 @@
|
|||
# @TEST-DOC: Test that Redis does not parse if it starts with the server data
|
||||
#
|
||||
# @TEST-EXEC: zeek -Cr $TRACES/redis/start-with-server.pcap base/protocols/redis %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
event Redis::command(c: connection, is_orig: bool, command: Redis::Command)
|
||||
{
|
||||
print "BAD", command;
|
||||
}
|
||||
|
||||
event Redis::server_data(c: connection, is_orig: bool, dat: Redis::ServerData)
|
||||
{
|
||||
print "BAD", dat;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue