Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/jsiwek/empty-lines'

Browse source 
* origin/topic/jsiwek/empty-lines:
  Add 'smtp_excessive_pending_cmds' weird
  Fix SMTP command string comparisons
  Improve handling of empty lines in several text protocol analyzers
  Add rate-limiting sampling mechanism for weird events
  Teach timestamp canonifier about timestamps before ~2001
This commit is contained in:
Jon Siwek 2018-08-20 15:35:16 -05:00
commit bcf97f70ea
31 changed files with 1078 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/http/main.bro
View file

@ -199,7 +199,7 @@ event http_request(c: connection, method: string, original_URI: string,
c$http$uri = unescaped_URI;
if ( method !in http_methods )
event conn_weird("unknown_HTTP_method", c, method);
Reporter::conn_weird("unknown_HTTP_method", c, method);
}
event http_reply(c: connection, version: string, code: count, reason: string) &priority=5

2
scripts/base/protocols/sip/main.bro
View file

@ -168,7 +168,7 @@ event sip_request(c: connection, method: string, original_URI: string, version:
c$sip$uri = original_URI;
if ( method !in sip_methods )
event conn_weird("unknown_SIP_method", c, method);
Reporter::conn_weird("unknown_SIP_method", c, method);
}
event sip_reply(c: connection, version: string, code: count, reason: string) &priority=5

2
scripts/base/protocols/smb/smb1-main.bro
View file

@ -309,7 +309,7 @@ event smb_pipe_request(c: connection, hdr: SMB1::Header, op_num: count)
if ( ! f?$uuid )
{
# TODO: figure out why this is happening.
event conn_weird("smb_pipe_request_missing_uuid", c, "");
Reporter::conn_weird("smb_pipe_request_missing_uuid", c, "");
return;
}
local arg = fmt("%s: %s",

2
scripts/base/protocols/ssl/main.bro
View file

@ -263,7 +263,7 @@ event ssl_extension_server_name(c: connection, is_orig: bool, names: string_vec)
{
c$ssl$server_name = names[0];
if ( |names| > 1 )
event conn_weird("SSL_many_server_names", c, cat(names));
Reporter::conn_weird("SSL_many_server_names", c, cat(names));
}
}