Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'security/topic/awelzel/148-ftp-skip-get-pending-commands-multi-line-response'

Browse source 
* security/topic/awelzel/148-ftp-skip-get-pending-commands-multi-line-response:
  ftp/main: Special case for intermediate reply lines
  ftp/main: Skip get_pending_command() for intermediate reply lines
This commit is contained in:
Tim Wojtulewicz 2023-04-11 14:50:47 -07:00
commit c670f3fdb2
14 changed files with 200 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/protocols/ftp/ftp-multiline-reply.zeek Normal file
View file

@ -0,0 +1,13 @@
# @TEST-DOC: Tests that c$ftp$reply_msg stays the same over a multiline reply.
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ipv6-multiline-reply.trace %INPUT > out
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff out
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "<init>", "USER", "PASS" };
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) {
print "ftp_reply", cont_resp, code, cat(c$ftp$reply_msg);
}

13
testing/btest/scripts/base/protocols/ftp/ftp-samba-retr.zeek Normal file
View file

@ -0,0 +1,13 @@
# @TEST-DOC: Tests interemediate lines to not confuse cwd tracking.
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ipv6-retr-samba.trace %INPUT > out
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff out
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "USER", "PASS", "RETR" };
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) {
print "ftp_reply", cont_resp, code, cat(c$ftp$reply_msg);
}