mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
d5fd29edcd
While we support initializing records via coercion from an expression
list, e.g.,
local x: X = [$x1=1, $x2=2];
this can sometimes obscure the code to readers, e.g., when assigning to
value declared and typed elsewhere. The language runtime has a similar
overhead since instead of just constructing a known type it needs to
check at runtime that the coercion from the expression list is valid;
this can be slower than just writing the readible code in the first
place, see #4559.
With this patch we use explicit construction, e.g.,
local x = X($x1=1, $x2=2);
29 lines
833 B
Text
29 lines
833 B
Text
##! Detect various potentially bad FTP activities.
|
|
|
|
@load base/frameworks/notice
|
|
@load base/protocols/ftp
|
|
|
|
module FTP;
|
|
|
|
export {
|
|
redef enum Notice::Type += {
|
|
## Indicates that a successful response to a "SITE EXEC"
|
|
## command/arg pair was seen.
|
|
Site_Exec_Success,
|
|
};
|
|
}
|
|
|
|
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &priority=3
|
|
{
|
|
local response_xyz = parse_ftp_reply_code(code);
|
|
|
|
# If a successful SITE EXEC command is executed, raise a notice.
|
|
if ( response_xyz$x == 2 &&
|
|
c$ftp$cmdarg$cmd == "SITE" &&
|
|
/[Ee][Xx][Ee][Cc]/ in c$ftp$cmdarg$arg )
|
|
{
|
|
NOTICE(Notice::Info($note=Site_Exec_Success, $conn=c,
|
|
$msg=fmt("FTP command: %s %s", c$ftp$cmdarg$cmd, c$ftp$cmdarg$arg),
|
|
$identifier=cat(c$id$orig_h, c$id$resp_h, "SITE EXEC")));
|
|
}
|
|
}
|