mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
1b3e8a611e
Intermediate lines of multiline replies usually do not contain valid status codes (even if servers may opt to include them). Their content may be anything and likely unrelated to the original command. There's little reason for us trying to match them with a corresponding command. OSS-Fuzz generated a large command reply with very many intermediate lines which caused long processing times due to matching every line with all currently pending commands. This is a DoS vector against Zeek. The new ipv6-multiline-reply.trace and ipv6-retr-samba.trace files have been extracted from the external ipv6.trace.
13 lines
451 B
Text
13 lines
451 B
Text
# @TEST-DOC: Tests interemediate lines to not confuse cwd tracking.
|
|
# @TEST-EXEC: zeek -b -r $TRACES/ftp/ipv6-retr-samba.trace %INPUT > out
|
|
# @TEST-EXEC: btest-diff ftp.log
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/conn
|
|
@load base/protocols/ftp
|
|
|
|
redef FTP::logged_commands += { "USER", "PASS", "RETR" };
|
|
|
|
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) {
|
|
print "ftp_reply", cont_resp, code, cat(c$ftp$reply_msg);
|
|
}
|