Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

smb: Fix &read_expire not in effect due to &default=string_set() usage

Browse source 
The SMB::State$recent_files field is meant to have expiring entries.
However, due to usage of &default=string_set(), the &read_expire
attribute is not respected causing unbounded state growth. Replace
&default=string_set() with &default=set().

Thanks to ya-sato on Slack for reporting!

Related: zeek/zeek-docs#179, #3513.
This commit is contained in:
Arne Welzel 2023-12-15 16:43:11 +01:00
parent 7a9a40f822
commit fea8ee2260
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/smb/main.zeek
View file

@ -157,7 +157,7 @@ export {
## A set of recent files to avoid logging the same ## A set of recent files to avoid logging the same
## files over and over in the smb files log. ## files over and over in the smb files log.
## This only applies to files seen in a single connection. ## This only applies to files seen in a single connection.
recent_files : set[string] &default=string_set() &read_expire=3min; recent_files : set[string] &default=set() &read_expire=3min;
}; };
## Everything below here is used internally in the SMB scripts. ## Everything below here is used internally in the SMB scripts.