mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
eb637f9f3e
Thanks to git this merge was less troublesome that I was afraid it would be. Not all tests pass yet though (and file hashes have changed unfortunately). Conflicts: cmake doc/scripts/DocSourcesList.cmake scripts/base/init-bare.bro scripts/base/protocols/ftp/main.bro scripts/base/protocols/irc/dcc-send.bro scripts/test-all-policy.bro src/AnalyzerTags.h src/CMakeLists.txt src/analyzer/Analyzer.cc src/analyzer/protocol/file/File.cc src/analyzer/protocol/file/File.h src/analyzer/protocol/http/HTTP.cc src/analyzer/protocol/http/HTTP.h src/analyzer/protocol/mime/MIME.cc src/event.bif src/main.cc src/util-config.h.in testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log testing/btest/Baseline/istate.events-ssl/receiver.http.log testing/btest/Baseline/istate.events-ssl/sender.http.log testing/btest/Baseline/istate.events/receiver.http.log testing/btest/Baseline/istate.events/sender.http.log
54 lines
1.6 KiB
Text
54 lines
1.6 KiB
Text
# @TEST-EXEC: bro -b -s myftp -r $TRACES/ftp/ipv4.trace %INPUT >dpd-ipv4.out
|
|
# @TEST-EXEC: bro -b -s myftp -r $TRACES/ftp/ipv6.trace %INPUT >dpd-ipv6.out
|
|
# @TEST-EXEC: bro -b -r $TRACES/ftp/ipv4.trace %INPUT >nosig-ipv4.out
|
|
# @TEST-EXEC: bro -b -r $TRACES/ftp/ipv6.trace %INPUT >nosig-ipv6.out
|
|
# @TEST-EXEC: btest-diff dpd-ipv4.out
|
|
# @TEST-EXEC: btest-diff dpd-ipv6.out
|
|
# @TEST-EXEC: btest-diff nosig-ipv4.out
|
|
# @TEST-EXEC: btest-diff nosig-ipv6.out
|
|
|
|
# DPD based on 'ip-proto' and 'payload' signatures should be independent
|
|
# of IP protocol.
|
|
|
|
@TEST-START-FILE myftp.sig
|
|
signature my_ftp_client {
|
|
ip-proto == tcp
|
|
payload /(|.*[\n\r]) *[uU][sS][eE][rR] /
|
|
tcp-state originator
|
|
event "matched my_ftp_client"
|
|
}
|
|
|
|
signature my_ftp_server {
|
|
ip-proto == tcp
|
|
payload /[\n\r ]*(120|220)[^0-9].*[\n\r] *(230|331)[^0-9]/
|
|
tcp-state responder
|
|
requires-reverse-signature my_ftp_client
|
|
enable "ftp"
|
|
event "matched my_ftp_server"
|
|
}
|
|
@TEST-END-FILE
|
|
|
|
@load base/utils/addrs
|
|
|
|
event bro_init()
|
|
{
|
|
# no analyzer attached to any port by default, depends entirely on sigs
|
|
print "|Analyzer::all_registered_ports()|", |Analyzer::all_registered_ports()|;
|
|
}
|
|
|
|
event signature_match(state: signature_state, msg: string, data: string)
|
|
{
|
|
print fmt("signature_match %s - %s", state$conn$id, msg);
|
|
}
|
|
|
|
event ftp_request(c: connection, command: string, arg: string)
|
|
{
|
|
print fmt("ftp_request %s:%s - %s %s", addr_to_uri(c$id$orig_h),
|
|
port_to_count(c$id$orig_p), command, arg);
|
|
}
|
|
|
|
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool)
|
|
{
|
|
print fmt("ftp_reply %s:%s - %s %s", addr_to_uri(c$id$resp_h),
|
|
port_to_count(c$id$resp_p), code, msg);
|
|
}
|