zeek/scripts
Arne Welzel cf9fe91705 pop3: Prevent unbounded state growth
The cmds list may grow unbounded due to the POP3 analyzer being in
multiLine mode after seeing `AUTH` in a Redis connection, but never
a `.` terminator. This can easily be provoked by the Redis ping
command.

This adds two heuristics: 1) Forcefully process the oldest commands in
the cmds list and cap it at max_pending_commands. 2) Start raising
analyzer violations if the client has been using more than
max_unknown_client_commands commands (default 10).

Closes #3936
2024-09-18 19:05:39 +02:00
..
base pop3: Prevent unbounded state growth 2024-09-18 19:05:39 +02:00
policy Add packet analyzer history 2024-08-12 12:21:00 +02:00
site telemetry: Deprecate prometheus.zeek policy script 2024-07-21 17:49:21 +02:00
spicy scripts/spicy: Reformat with spicy-format 2024-09-05 19:11:05 +02:00
zeekygen test-all-policy: Do not load iso-9660.zeek 2024-02-26 17:58:26 +01:00
CMakeLists.txt Use the same rules as cmake submodule to reformat Zeek 2023-05-09 08:31:43 -07:00
test-all-policy.zeek Remove deprecated load-balacing policy script 2024-08-07 11:58:21 -07:00