zeek/scripts
Arne Welzel 672602dae7 MySQL: Fix endianness, introduce mysql_eof() event
We were parsing MySQL using bigendian even though the protocol is
specified as with "least significant byte first" [1]. This is most
problematic when parsing length encoded strings with 2 byte length
fields...

Further, I think, the EOF_Packet parsing was borked, either due to
testing the CLIENT_DEPRECATE_EOF with the wrong endianness, or due to
the workaround in Resultset processing raising mysql_ok(). Introduce a
new mysql_eof() that triggers for EOF_Packet's and remove the fake
mysql_ok() Resultset invocation to fix. Adapt the mysql script and tests
to account for the new event.

This is a quite backwards incompatible change on the event level, but
due to being quite buggy in general, doubt this matters to many.

I think there is more buried, but this fixes the violation of the simple
"SHOW ENGINE INNODB STATUS" and the existing tests continue to
succeed...

[1] https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_basic_dt_integers.html
2023-01-27 10:59:23 +01:00
..
base MySQL: Fix endianness, introduce mysql_eof() event 2023-01-27 10:59:23 +01:00
policy intel/seen/file-names: Use file_over_new_connection() 2023-01-10 10:10:28 +01:00
site Deprecate misc/scan.zeek 2022-08-23 09:10:53 +02:00
zeekygen mqtt: Move from policy/ into base/ 2022-11-30 10:14:20 +01:00
CMakeLists.txt Add base/misc/installation.zeek, with Zeek installation directories 2022-05-23 14:16:59 -07:00
test-all-policy.zeek mqtt: Move from policy/ into base/ 2022-11-30 10:14:20 +01:00