Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 09:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Update FTP EPSV response processing for IPv6

Browse source
This commit is contained in:
Daniel Thayer 2012-02-10 16:55:15 -06:00
parent 42d6440bb2
commit 74899e29fe
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/ftp/main.bro
View file

@ -270,7 +270,7 @@ event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &prior
{ {
c$ftp$passive=T; c$ftp$passive=T;
if ( code == 229 && data$h == 0.0.0.0 ) if ( code == 229 && data$h == :: )
data$h = id$resp_h; data$h = id$resp_h;
ftp_data_expected[data$h, data$p] = c$ftp; ftp_data_expected[data$h, data$p] = c$ftp;

4
src/bro.bif
View file

@ -2613,7 +2613,7 @@ function parse_ftp_port%(s: string%): ftp_port
## The format is ``EPRT<space><d><net-prt><d><net-addr><d><tcp-port><d>``, ## The format is ``EPRT<space><d><net-prt><d><net-addr><d><tcp-port><d>``,
## where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``). ## where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``).
## ##
## s: The string of the FTP PORT command, e.g., ``"10,0,0,1,4,31"``. ## s: The string of the FTP EPRT command, e.g., ``"|1|10.0.0.1|1055|"``.
## ##
## Returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]`` ## Returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]``
## ##
@ -2653,7 +2653,7 @@ function parse_ftp_pasv%(str: string%): ftp_port
## The format is ``<text> (<d><d><d><tcp-port><d>)``, where ``<d>`` is a ## The format is ``<text> (<d><d><d><tcp-port><d>)``, where ``<d>`` is a
## delimiter in the ASCII range 33-126 (usually ``|``). ## delimiter in the ASCII range 33-126 (usually ``|``).
## ##
## str: The string containing the result of the FTP PASV command. ## str: The string containing the result of the FTP EPSV command.
## ##
## Returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]`` ## Returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]``
## ##