zeek/scripts/base
Arne Welzel 672602dae7 MySQL: Fix endianness, introduce mysql_eof() event
We were parsing MySQL using bigendian even though the protocol is
specified as with "least significant byte first" [1]. This is most
problematic when parsing length encoded strings with 2 byte length
fields...

Further, I think, the EOF_Packet parsing was borked, either due to
testing the CLIENT_DEPRECATE_EOF with the wrong endianness, or due to
the workaround in Resultset processing raising mysql_ok(). Introduce a
new mysql_eof() that triggers for EOF_Packet's and remove the fake
mysql_ok() Resultset invocation to fix. Adapt the mysql script and tests
to account for the new event.

This is a quite backwards incompatible change on the event level, but
due to being quite buggy in general, doubt this matters to many.

I think there is more buried, but this fixes the violation of the simple
"SHOW ENGINE INNODB STATUS" and the existing tests continue to
succeed...

[1] https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_basic_dt_integers.html
2023-01-27 10:59:23 +01:00
..
files Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
frameworks Fix a docstring typo 2023-01-10 18:49:19 -08:00
misc annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
packet-protocols gtpv1: Do not register for protocol detection 2022-08-26 10:47:38 +02:00
protocols MySQL: Fix endianness, introduce mysql_eof() event 2023-01-27 10:59:23 +01:00
utils Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
init-bare.zeek TimerMgr: Add back max_timer_expires=0 special case 2022-11-27 15:02:14 +01:00
init-default.zeek frameworks/dpd: Move to frameworks/analyzer/dpd, load by default 2022-08-31 16:50:47 +02:00
init-frameworks-and-bifs.zeek analyzer: Add analyzer.log for logging violations/confirmations 2023-01-09 18:11:49 +01:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00