mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
7e895a3a2f
The notable difference here is that ftp.log now logs by default the PORT, PASV, EPRT, EPSV commands as well as a separate line for ftp-data channels in which file extraction was requested. This difference isn't a direct result of now doing the file extraction through the file analysis framework, it's just because I noticed even the old way of tracking extracted-file name didn't work right and this was the way I came up with so that a locally extracted file can be associated with a data channel and then that data channel associated with a control channel.
12 lines
439 B
Text
12 lines
439 B
Text
# This tests FTP file extraction.
|
|
#
|
|
# @TEST-EXEC: bro -r $TRACES/ftp/ipv4.trace %INPUT
|
|
# @TEST-EXEC: btest-diff conn.log
|
|
# @TEST-EXEC: btest-diff ftp.log
|
|
# @TEST-EXEC: btest-diff ftp-item-Rqjkzoroau4-0.dat
|
|
# @TEST-EXEC: btest-diff ftp-item-BTsa70Ua9x7-1.dat
|
|
# @TEST-EXEC: btest-diff ftp-item-VLQvJybrm38-2.dat
|
|
# @TEST-EXEC: btest-diff ftp-item-zrfwSs9K1yk-3.dat
|
|
|
|
redef FTP::logged_commands += {"LIST"};
|
|
redef FTP::extract_file_types=/.*/;
|