zeek/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-samba-retr/out
Arne Welzel 1b3e8a611e ftp/main: Skip get_pending_command() for intermediate reply lines
Intermediate lines of multiline replies usually do not contain valid status
codes (even if servers may opt to include them). Their content may be anything
and likely unrelated to the original command. There's little reason for us
trying to match them with a corresponding command.

OSS-Fuzz generated a large command reply with very many intermediate lines
which caused long processing times due to matching every line with all
currently pending commands.
This is a DoS vector against Zeek. The new ipv6-multiline-reply.trace and
ipv6-retr-samba.trace files have been extracted from the external ipv6.trace.
2023-03-23 13:50:36 +01:00

16 lines
872 B
Text

### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
ftp_reply, F, 220, 2001:6f8:200:1::5:33 FTP server ready
ftp_reply, F, 331, Anonymous login ok, send your complete email address as your password
ftp_reply, F, 230, Anonymous access granted, restrictions apply
ftp_reply, F, 257, "/" is the current directory
ftp_reply, T, 250, See http://samba.org/ for a list of mirror sites
ftp_reply, F, 250, CWD command successful
ftp_reply, F, 200, Mode set to S
ftp_reply, F, 200, Type set to I
ftp_reply, F, 213, 34826629
ftp_reply, F, 213, 20120430122210
ftp_reply, F, 200, Mode set to S
ftp_reply, F, 200, Type set to I
ftp_reply, F, 229, Entering Extended Passive Mode (|||63282|)
ftp_reply, F, 150, Opening BINARY mode data connection for samba-3.4.17.tar.gz (34826629 bytes)
ftp_reply, F, 226, Transfer complete