Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

ftp: Limit user, password, arg and reply_msg column sizes in log

Browse source 
The user and password fields are replicated to each of the ftp.log
entries. Using a very large username (100s of KBs) allows to bloat
the log without actually sending much traffic. Further, limit the
arg and reply_msg columns to large, but not unbounded values.
This commit is contained in:
Arne Welzel 2023-02-14 20:34:52 +01:00 • committed by Tim Wojtulewicz
parent 3c330122c6
commit f56785740c
10 changed files with 153 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/scripts/base/protocols/ftp/ftp-max-arg-length.zeek Normal file
View file

@ -0,0 +1,12 @@
# Test truncation of the arg field in the ftp.log.
#
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ipv4.trace %INPUT
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::logged_commands += { "CWD", "USER" };
redef FTP::max_arg_length = 13;
redef FTP::max_reply_msg_length = 17;

13
testing/btest/scripts/base/protocols/ftp/ftp-max-user-length.zeek Normal file
View file

@ -0,0 +1,13 @@
# Test truncation of the user and password fields in the log.
# The password is "test", the user is "anonymous".
#
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ipv4.trace %INPUT
# @TEST-EXEC: btest-diff ftp.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/conn
@load base/protocols/ftp
redef FTP::max_user_length = 4;
redef FTP::max_password_length = 2;
redef FTP::default_capture_password = T;