mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 00:58:19 +00:00
ftp: Do not base seq on number of pending commands
Previously, seq was computed as the result of |pending_commands|+1. This opened the possibility to override queued commands, as well as logging the same pending ftp reply multiple times. For example, when commands 1, 2, 3 are pending, command 1 may be dequeued, but the incoming command then receives seq 3 and overrides the already pending command 3. The second scenario happens when ftp_reply() selected command 3 as pending for logging, but is then followed by many ftp_request() events. This resulted in command 3's response being logged for every following ftp_request() over and over again. Avoid both scenarios by tracking the command sequence as an absolute counter.
This commit is contained in:
parent
a5b94f04fd
commit
ce4cbac1ef
4 changed files with 8 additions and 4 deletions
|
@ -162,6 +162,7 @@ connection {
|
|||
* ts: time, log=F, optional=F
|
||||
}
|
||||
* command: string, log=T, optional=T
|
||||
* command_seq: count, log=F, optional=T
|
||||
* cwd: string, log=F, optional=T
|
||||
* data_channel: record FTP::ExpectedDataChannel, log=T, optional=T
|
||||
FTP::ExpectedDataChannel {
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue