29 Commits (bb2760d2218d2098a0907abda0d693d3b6f1b8c0)

Author	SHA1	Message	Date
Philippe Antoine	d47dba27bf	all: remove unused literals	2 years ago
Victor Julien	9ab5480257	ftp: rename enum to fix spelling	2 years ago
Victor Julien	47fe88b79b	ftp: rearrange command struct to be more compact ... ./app-layer-ftp.h:92:16: warning: Excessive padding in 'struct FtpCommand_' (11 padding bytes, where 3 is optimal). Optimal fields order: command_name, command, command_length, consider reordering the fields or adding explicit padding members [optin.performance.Padding] typedef struct FtpCommand_ { ~~~~~~~^~~~~~~~~~~~~	2 years ago
Shivani Bhardwaj	06caef988c	detect/ftp: use AppLayerResult API	2 years ago
Victor Julien	c27df6304d	app-layer: introduce common AppLayerStateData API ... Add per state structure for storing flags and other variables.	2 years ago
Philippe Antoine	5a00acece2	ftp: remove temporary fields from state ... As input, input_len and direction only last for the scope of one call of AppLayerParserParse, it is not necessary to keep them in FtpState which lives longer, so we consume less memory.	3 years ago
Jason Ish	cf8ed576e0	ftp: truncate command data that is too long ... FTP control commands will be buffered forever until a new line is seen, this can lead to memory exhaustion in Suricata. To fix, set an upper bound, 4096 bytes on the size of the command that is saved in the transaction. The input continues to be parsed to find the end of the command so the parser can continue to move onto the next command. The result is that the command data in the transaction is truncated, which also shows up in the ftp transaction logs. This value is configurable with the max-line-length field in the ftp app-layer.protocols section. As FTP doesn't have events at this time, add a new fields to eve-log that specificy if the request, or the response has been truncated. Ticket #5024	3 years ago
Philippe Antoine	defce022b4	ftp: fix int warnings ... Explicitly truncate a file name if it is longer than UINT16_MAX	3 years ago
Jason Ish	9c67c634c1	app-layer: include DetectEngineState in AppLayerTxData ... Every transaction has an existing mandatory field, tx_data. As DetectEngineState is also mandatory, include it in tx_data. This allows us to remove the boilerplate every app-layer has for managing detect engine state.	3 years ago
Victor Julien	c98f597831	ftp: support AppLayerTxData	5 years ago
Jeff Lucovsky	648bd5afff	output/ftp: Use "Eve" prefix with FTP helpers ... This commit changes the prefix of the FTP helper routines from Json to Eve.	5 years ago
Jeff Lucovsky	03de315bc2	ftp/eve: Convert FTP logging to use JsonBuilder ... This commit converts the FTP logging mechanisms to use JsonBuilder.	5 years ago
Jason Ish	b1beb76fd7	ftpdata: add tx detect flags	5 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	6 years ago
Jeff Lucovsky	09ab032a8d	ftp: Use MPM for command lookup	6 years ago
Jeff Lucovsky	4f2a485c55	ftp: Remove LIBJANSSON guards	6 years ago
Jeff Lucovsky	3df2b3437c	eve/ftp: Move "get next line" into app-layer-ftp.c	6 years ago
Jeff Lucovsky	2149807bd6	eve/ftp: Transaction support for unmatched requests ... Modified transaction logic to create a new transaction with each request; replies location transactions by using the oldest "open" (unmatched) transaction or the last transaction if none are open.	6 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	6 years ago
Jeff Lucovsky	4f33b8c18d	decode: Improved FTP active mode handling ... This changeset addresses 2 issues: - 2459 - 2527 and improves handling for FTP active mode over IPv4 and IPv6. Active mode is triggered when the FTP client conveys the port that should be used for a data connection (PORT, EPRT). When this occurs, the FTP state is marked as "active".	6 years ago
Eric Leblond	711b6fb389	app-layer-ftp: add memcap for ftp ... Add a memory cap for the FTP protocol.	7 years ago
Eric Leblond	b0a6934431	app-layer-ftp: add ftp-data support ... Use expectation to be able to identify connections that are ftp data. It parses the PASV response, STOR message and the RETR message to provide extraction of files. Implementation in Rust of FTP messages parsing is available. Also this patch changes some var name prefixed by ssh to ftp.	7 years ago
Mats Klepsland	11b9e6fdab	app-layer-ftp: add STARTTLS support	8 years ago
Victor Julien	402eb645a0	ftp: parser and ftpbounce update ... Convert parser to TX API. Convert ftpbounce keyword to use that.	8 years ago
Anoop Saldanha	6ea8ac44ff	FTP parser updated to not use the archaic App layer feature of AppLayerParserResultElmt. ... The parser otherwise remains pretty much the same.	11 years ago
Anoop Saldanha	80c08f8642	Updated the ftp response handler to return without doing anything. ... Currently the processing happening inside the handler is not being used anywhere else in the engine.	11 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Pablo Rincon	f2f9b83280	Adding FTP app layer parser and ftpbounce detection at L7	15 years ago