Evan Typanski
5af510d5d7
Handle Redis protocol message separately
...
Closes #4504
Messages from pub/sub need separate handling in order to not mess up
client request/reply correlation.
2025-06-11 18:52:22 -04:00
Evan Typanski
b4429a995a
spicy-redis: Separate error replies from success
2025-05-27 09:31:25 -04:00
Evan Typanski
d5b121db14
spicy-redis: Cleanup scripts and tests
...
- Recomputes checksums for pcaps to keep clean
- Removes some tests that had big pcaps or weren't necessary
- Cleans up scripting names and minor points
- Comments out Spicy code that causes a build failure now with a TODO to
uncomment it
2025-05-27 09:29:13 -04:00
Evan Typanski
11777bd6d5
spciy-redis: Bring Redis analyzer into Zeek proper
2025-05-27 09:28:12 -04:00
Evan Typanski
aef9fe11dc
spicy-redis: Abort parsing if server data comes first
...
Redis seems to only want client data first to request server data. The
DPD signature seems to pick up on some cases where server data comes
first, but is otherwise "valid" RESP. See if this helps lower FP rates.
2025-05-27 09:28:12 -04:00
Evan Typanski
7f28ec8bc5
spicy-redis: Add dpd signature and clean pcaps
2025-05-27 09:28:12 -04:00
Evan Typanski
f0e9f46c7c
spicy-redis: Add some commands and touch up parsing
2025-05-27 09:28:12 -04:00
Evan Typanski
22bda56af3
spicy-redis: Add some script logic for logging
...
Also "rebrands" from RESP to Redis.
2025-05-27 09:28:12 -04:00
Evan Typanski
757cbbf902
spicy-redis: Separate client/server
...
This makes the parser more official and splits the client/server out
from each other. Apparently they're different enough to be separate.
2025-05-27 09:28:12 -04:00
Evan Typanski
f0f2969a66
spicy-redis: Touchup logging and Spicy issues
2025-05-27 09:28:12 -04:00
Evan Typanski
97d26a689d
spicy-redis: Add synchronization and pipeline support
...
Also adds some command support
2025-05-27 09:28:12 -04:00
Evan Typanski
4210e62e57
spicy-redis: Begin Spicy Redis analyzer
2025-05-27 09:28:12 -04:00
