diff --git a/scripts/base/protocols/ftp/info.zeek b/scripts/base/protocols/ftp/info.zeek index 733c01729c..d0122819fe 100644 --- a/scripts/base/protocols/ftp/info.zeek +++ b/scripts/base/protocols/ftp/info.zeek @@ -64,6 +64,9 @@ export { ## to are tracked here. pending_commands: PendingCmds; + ## Sequence number of previous command. + command_seq: count &default=0; + ## Indicates if the session is in active or passive mode. passive: bool &default=F; diff --git a/scripts/base/protocols/ftp/main.zeek b/scripts/base/protocols/ftp/main.zeek index 89c06765c8..85b04038be 100644 --- a/scripts/base/protocols/ftp/main.zeek +++ b/scripts/base/protocols/ftp/main.zeek @@ -165,7 +165,7 @@ function set_ftp_session(c: connection) Conn::register_removal_hook(c, finalize_ftp); # Add a shim command so the server can respond with some init response. - add_pending_cmd(c$ftp$pending_commands, "", ""); + add_pending_cmd(c$ftp$pending_commands, ++c$ftp$command_seq, "", ""); } } @@ -270,7 +270,7 @@ event ftp_request(c: connection, command: string, arg: string) &priority=5 # Queue up the new command and argument if ( |c$ftp$pending_commands| < max_pending_commands ) - add_pending_cmd(c$ftp$pending_commands, command, arg); + add_pending_cmd(c$ftp$pending_commands, ++c$ftp$command_seq, command, arg); else Reporter::conn_weird("FTP_too_many_pending_commands", c, cat(|c$ftp$pending_commands|), "FTP"); diff --git a/scripts/base/protocols/ftp/utils-commands.zeek b/scripts/base/protocols/ftp/utils-commands.zeek index 31466970a5..b470cecc01 100644 --- a/scripts/base/protocols/ftp/utils-commands.zeek +++ b/scripts/base/protocols/ftp/utils-commands.zeek @@ -78,9 +78,9 @@ export { }; } -function add_pending_cmd(pc: PendingCmds, cmd: string, arg: string): CmdArg +function add_pending_cmd(pc: PendingCmds, seq: count, cmd: string, arg: string): CmdArg { - local ca = [$cmd = cmd, $arg = arg, $seq=|pc|+1, $ts=network_time()]; + local ca = [$cmd = cmd, $arg = arg, $seq=seq, $ts=network_time()]; pc[ca$seq] = ca; return ca; diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing index bb06f51cb9..27e1f8d148 100644 --- a/testing/external/commit-hash.zeek-testing +++ b/testing/external/commit-hash.zeek-testing @@ -1 +1 @@ -f0dfda82f616d478df1a290116b4b7efdd82f00a +9e2b8aaa316d6b818fa32c730fcc90ca8b401b68 diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private index 3a2dfa8e61..d42a341592 100644 --- a/testing/external/commit-hash.zeek-testing-private +++ b/testing/external/commit-hash.zeek-testing-private @@ -1 +1 @@ -eea2f9972f5b103048a40d07b3f14c41d92336bc +0e810e51b5fdeacfab53b5655023190c84f86f2e