zeek/scripts/base
Arne Welzel 2732efd12e ftp: Do not base seq on number of pending commands
Previously, seq was computed as the result of |pending_commands|+1. This
opened the possibility to override queued commands, as well as logging
the same pending ftp reply multiple times.

For example, when commands 1, 2, 3 are pending, command 1 may be dequeued,
but the incoming command then receives seq 3 and overrides the already
pending command 3. The second scenario happens when ftp_reply() selected
command 3 as pending for logging, but is then followed by many ftp_request()
events. This resulted in command 3's response being logged for every
following ftp_request() over and over again.

Avoid both scenarios by tracking the command sequence as an absolute counter.
2023-10-27 11:24:00 -07:00
..
files Add extract_limit_includes_missing option for file extraction 2023-09-14 12:11:42 -07:00
frameworks Merge remote-tracking branch 'origin/topic/awelzel/mmdb-fix-and-tests' 2023-10-24 13:13:16 -07:00
misc Revert "Merge remote-tracking branch 'origin/topic/vern/at-if-analyze'" 2023-05-31 09:20:33 +02:00
packet-protocols PPP: Add PPP analyzer to handle LINKTYPE_PPP (0x9) 2023-08-23 16:41:19 +02:00
protocols ftp: Do not base seq on number of pending commands 2023-10-27 11:24:00 -07:00
utils all: Fix typos identified by typos pre-commit hook 2023-06-13 17:57:32 +02:00
init-bare.zeek Merge remote-tracking branch 'origin/topic/awelzel/mmdb-fix-and-tests' 2023-10-24 13:13:16 -07:00
init-default.zeek quic: Integrate as default analyzer 2023-10-11 14:10:22 +02:00
init-frameworks-and-bifs.zeek Do not load Spicy scripts if Spicy is not available. 2023-05-16 10:21:21 +02:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00