mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
4656faed6c
Processing out-of-order commands or finishing commands based on invalid
server responses resulted in inconsistent analyzer state, potentially
triggering null pointer references for crafted traffic.
This commit reworks cf9fe91705 such that
too many pending commands are simply discarded, rather than any attempt
being made to process them. Further, invalid server responses do not
result in command completion anymore.
Test PCAP was crafted based on traffic produced by the OSS-Fuzz reproducer.
Closes #215
22 lines
713 B
Text
22 lines
713 B
Text
# @TEST-DOC: The POP3 signature triggered on Redis traffic. Ensure the analyzer is eventually removed to avoid.
|
|
# @TEST-EXEC: zeek -C -b -r $TRACES/pop3/redis-50-pings.pcap %INPUT >out
|
|
# @TEST-EXEC: btest-diff conn.log
|
|
# @TEST-EXEC: btest-diff out
|
|
# @TEST-EXEC: btest-diff weird.log
|
|
# @TEST-EXEC: btest-diff analyzer.log
|
|
|
|
@load base/frameworks/notice/weird
|
|
@load base/protocols/conn
|
|
@load base/protocols/pop3
|
|
|
|
redef POP3::max_unknown_client_commands = 3;
|
|
|
|
event pop3_request(c: connection, is_orig: bool, cmd: string, arg: string)
|
|
{
|
|
print c$uid, "pop3_request", is_orig, cmd, arg;
|
|
}
|
|
|
|
event pop3_reply(c: connection, is_orig: bool, cmd: string, arg: string)
|
|
{
|
|
print c$uid, "pop3_reply", is_orig, cmd, arg;
|
|
}
|