zeek/scripts/base/protocols
Arne Welzel 7665e808a2 ftp/main: Special case for intermediate reply lines
The medium.trace in the private external test suite contains one
session/server that violates the multi-line reply protocol and
happened to work out fairly well regardless due to how we looked
up the pending commands unconditionally before.

Continue to match up reply lines that "look like they contain status codes"
even if cont_resp = T. This still improves runtime for the OSS-Fuzz
generated test case and keeps the external baselines valid.

The affected session can be extracted as follows:

    zcat Traces/medium.trace.gz | tcpdump -r  - 'port 1491 and port 21'

We could push this into the analyzer, too, minimally the RFC says:

    > If an intermediary line begins with a 3-digit number, the Server
    > must pad the front  to avoid confusion.
2023-04-03 14:05:13 +02:00
..
conn Expand Conn::Info$duration comment to clarify TCP end-of-connection handling 2022-11-30 09:39:57 -08:00
dce-rpc Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
dhcp Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
dnp3 Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
dns dns: Remove AD and CD flags from log 2023-03-16 10:09:27 +01:00
finger Add BIF have_spicy_analyzers(). 2023-02-03 13:47:26 +01:00
ftp ftp/main: Special case for intermediate reply lines 2023-04-03 14:05:13 +02:00
http {http,smtp}/entities: Align header regexes with extract_filename_from_content_disposition() 2022-11-08 16:45:25 -07:00
imap Merge remote-tracking branch 'origin/topic/seth/zeek_init' 2019-04-19 11:24:29 -07:00
irc annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
krb Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
modbus Add a field to Modbus/TCP log to indicate the Modbus PDU type 2022-07-24 02:41:26 +00:00
mqtt mqtt: Move from policy/ into base/ 2022-11-30 10:14:20 +01:00
mysql MySQL: Fix endianness, introduce mysql_eof() event 2023-01-27 10:59:23 +01:00
ntlm scripts/dce-rpc,ntlm: Do not load base/frameworks/dpd 2022-08-31 16:50:37 +02:00
ntp &is_set => &is_assigned 2021-02-04 12:18:46 -08:00
pop3 Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
radius deprecation messages for unused base script functions 2022-05-27 14:36:30 -07:00
rdp Merge remote-tracking branch 'jeff-bb/patch-2' 2023-01-23 12:50:23 -07:00
rfb Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
sip Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
smb smb1: Prevent accessing uninitialized referenced_tree 2023-01-27 19:22:13 +01:00
smtp {http,smtp}/entities: Align header regexes with extract_filename_from_content_disposition() 2022-11-08 16:45:25 -07:00
snmp Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
socks Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
ssh ssh: Test for c$ssh$analyzer_id existence 2022-11-16 16:35:57 +01:00
ssl Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
syslog Add BIF have_spicy_analyzers(). 2023-02-03 13:47:26 +01:00
tunnels Add Teredo packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
xmpp Merge remote-tracking branch 'origin/topic/seth/zeek_init' 2019-04-19 11:24:29 -07:00