Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixing FTP cwd getting overlue long.

Browse source 
Now storing them compressed.
This commit is contained in:
Robin Sommer 2016-05-28 12:15:51 -07:00
parent c74effad42
commit d195f1b047
6 changed files with 5555 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/ftp/main.bro
View file

@ -241,10 +241,10 @@ event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &prior
if ( [c$ftp$cmdarg$cmd, code] in directory_cmds )
{
if ( c$ftp$cmdarg$cmd == "CWD" )
c$ftp$cwd = build_path(c$ftp$cwd, c$ftp$cmdarg$arg);
c$ftp$cwd = build_path_compressed(c$ftp$cwd, c$ftp$cmdarg$arg);
else if ( c$ftp$cmdarg$cmd == "CDUP" )
c$ftp$cwd = cat(c$ftp$cwd, "/..");
c$ftp$cwd = build_path_compressed(c$ftp$cwd, "/..");
else if ( c$ftp$cmdarg$cmd == "PWD" || c$ftp$cmdarg$cmd == "XPWD" )
c$ftp$cwd = extract_path(msg);

10
testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/conn.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open 2016-05-28-16-43-09
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1464385864.999633 CXWv6p3arKYeMETxOg 10.3.22.91 58218 10.167.25.101 21 tcp ftp 600.931043 41420 159830 S1 - - 233 ShAdDa 4139 206914 4178 326799 (empty)
#close 2016-05-28-16-43-09

1384
testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/ftp.log Normal file
View file

File diff suppressed because it is too large Load diff

4147
testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/output.log Normal file
View file

File diff suppressed because it is too large Load diff

BIN
testing/btest/Traces/ftp/cwd-navigation.pcap Normal file
View file

Binary file not shown.

12
testing/btest/scripts/base/protocols/ftp/cwd-navigation.bro Normal file
View file

@ -0,0 +1,12 @@
# @TEST-EXEC: bro -r $TRACES/ftp/cwd-navigation.pcap >output.log %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff output.log
# Make sure we're tracking the CWD correctly.
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &priority=10
{
print "CWD", c$ftp$cwd;
}