Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

ftp: Limit pending commands to FTP::max_pending_commands (default 20)

Browse source
This commit is contained in:
Arne Welzel 2022-09-28 12:45:34 +02:00 • committed by Tim Wojtulewicz
parent d2689379bc
commit c132d140ae
9 changed files with 91 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

24
testing/btest/scripts/base/protocols/ftp/ftp-max-pending-commands.zeek Normal file
View file

@ -0,0 +1,24 @@
# @TEST-DOC: Artificially generated pcap where the FTP client sends a batch of commands before the server ever responds with a ready message. Cap max_pending_commands at 5 and verify generation of weird.log and no scripting errors.
#
# @TEST-EXEC: zeek -b -r $TRACES/ftp/fake-server-delays-all.pcap %INPUT > output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: test ! -f reporter.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::max_pending_commands = 5;
redef FTP::logged_commands += { "USER", "SYST" };
event ftp_request(c: connection, command: string, arg: string)
{
print "ftp_request", c$uid, command, arg;
}
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool)
{
print "ftp_reply", c$uid, code, msg;
}