zeek/scripts
Arne Welzel b745556d36 ftp: Do not base seq on number of pending commands
Previously, seq was computed as the result of |pending_commands|+1. This
opened the possibility to override queued commands, as well as logging
the same pending ftp reply multiple times.

For example, when commands 1, 2, 3 are pending, command 1 may be dequeued,
but the incoming command then receives seq 3 and overrides the already
pending command 3. The second scenario happens when ftp_reply() selected
command 3 as pending for logging, but is then followed by many ftp_request()
events. This resulted in command 3's response being logged for every
following ftp_request() over and over again.

Avoid both scenarios by tracking the command sequence as an absolute counter.
2023-10-25 10:05:09 -07:00
..
base ftp: Do not base seq on number of pending commands 2023-10-25 10:05:09 -07:00
policy Merge remote-tracking branch 'origin/topic/jazoff/gh-3268t ' 2023-09-08 11:09:56 -07:00
site Merge remote-tracking branch 'origin/topic/awelzel/no-metrics-centralization' 2023-06-21 15:42:10 -07:00
spicy Simplify code generated for Spicy analyzer port ranges. 2023-05-29 12:20:44 +02:00
zeekygen Merge remote-tracking branch 'origin/topic/awelzel/cluster-at-if-removal' 2023-06-12 11:23:01 -07:00
CMakeLists.txt Use the same rules as cmake submodule to reformat Zeek 2023-05-09 08:31:43 -07:00
test-all-policy.zeek Merge remote-tracking branch 'origin/topic/awelzel/no-metrics-centralization' 2023-06-21 15:42:10 -07:00