Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
zeek/scripts/base/protocols/ftp
History
Arne Welzel 7665e808a2 ftp/main: Special case for intermediate reply lines 
The medium.trace in the private external test suite contains one
session/server that violates the multi-line reply protocol and
happened to work out fairly well regardless due to how we looked
up the pending commands unconditionally before.

Continue to match up reply lines that "look like they contain status codes"
even if cont_resp = T. This still improves runtime for the OSS-Fuzz
generated test case and keeps the external baselines valid.

The affected session can be extracted as follows:

    zcat Traces/medium.trace.gz | tcpdump -r  - 'port 1491 and port 21'

We could push this into the analyzer, too, minimally the RFC says:

    > If an intermediary line begins with a 3-digit number, the Server
    > must pad the front  to avoid confusion.
2023-04-03 14:05:13 +02:00
..
__load__.zeek Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
dpd.sig Moved DPD signatures into script specific directories. 2013-07-09 22:44:55 -04:00
files.zeek scripts: Migrate table iteration to blank identifiers 2022-10-24 10:36:09 +02:00
gridftp.zeek Small bugfix and updates for external test hashes (SSL/X509) 2021-06-29 15:25:08 +01:00
info.zeek Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
main.zeek ftp/main: Special case for intermediate reply lines 2023-04-03 14:05:13 +02:00
README Add README files for base/protocols 2013-10-17 12:47:32 -05:00
utils-commands.zeek deprecation messages for unused base script functions 2022-05-27 14:36:30 -07:00
utils.zeek GH-234: rename Broxygen to Zeexygen along with roles/directives 2019-04-22 19:45:50 -07:00

README 

Support for File Transfer Protocol (FTP) analysis.