Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

detect/ftp.command: Add sticky buffer #12457

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Conversation

jlucovsky
Copy link
Contributor

Continuation of #12439

Issue: 7502

Add a sticky buffer for "ftp.command" for matching on FTP command names.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7502

Describe changes:

  • Add a sticky buffer for ftp.command
  • Briefly document ftp.command sticky buffer.

Updates

  • Documentation: restored missing FTP documentation, removed mention of new keyword from update doc.

Provide values to any of the below to override the defaults.

  • To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2245
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

Issue: 7502

Add a sticky buffer for "ftp.command" for matching on FTP command names.
Issue: 7502

This commit documents the new FTP sticky buffer "ftp.command".
Copy link

codecov bot commented Jan 23, 2025

Codecov Report

Attention: Patch coverage is 94.44444% with 2 lines in your changes missing coverage. Please review.

Project coverage is 80.64%. Comparing base (95e8427) to head (e0ed94d).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #12457      +/-   ##
==========================================
+ Coverage   80.63%   80.64%   +0.01%     
==========================================
  Files         920      921       +1     
  Lines      258704   258740      +36     
==========================================
+ Hits       208595   208665      +70     
+ Misses      50109    50075      -34     
Flag Coverage Δ
fuzzcorpus 56.83% <50.00%> (+0.02%) ⬆️
livemode 19.43% <50.00%> (+0.03%) ⬆️
pcap 44.31% <50.00%> (-0.03%) ⬇️
suricata-verify 63.23% <94.44%> (-0.03%) ⬇️
unittests 58.52% <50.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

.. container:: example-rule

alert ftp any any -> any any (:example-rule-options:`ftp.command; content:PASS;1;` sid: 1;)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

example looks a bit odd. Should use content:"PASS"; I think?

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 24330

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants