Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

detect/ftp.command: Add sticky buffer #12439

Closed
wants to merge 2 commits into from
Closed

Conversation

jlucovsky
Copy link
Contributor

Continuation of #12428

Issue: 7502

Add a sticky buffer for "ftp.command" for matching on FTP command names.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7502

Describe changes:

  • Add a sticky buffer for ftp.command
  • Briefly document ftp.command sticky buffer.

Updates

  • Rebase
  • Documentation for supported ftp rule keywords.

Provide values to any of the below to override the defaults.

  • To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2245
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

Issue: 7502

Add a sticky buffer for "ftp.command" for matching on FTP command names.
Issue: 7502

This commit documents the new FTP sticky buffer "ftp.command".
Copy link

codecov bot commented Jan 21, 2025

Codecov Report

Attention: Patch coverage is 50.00000% with 18 lines in your changes missing coverage. Please review.

Project coverage is 80.62%. Comparing base (95e8427) to head (2e5ceee).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #12439      +/-   ##
==========================================
- Coverage   80.63%   80.62%   -0.01%     
==========================================
  Files         920      921       +1     
  Lines      258704   258740      +36     
==========================================
+ Hits       208595   208621      +26     
- Misses      50109    50119      +10     
Flag Coverage Δ
fuzzcorpus 56.81% <50.00%> (-0.01%) ⬇️
livemode 19.40% <50.00%> (+<0.01%) ⬆️
pcap 44.30% <50.00%> (-0.04%) ⬇️
suricata-verify 63.25% <50.00%> (-0.02%) ⬇️
unittests 58.52% <50.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Copy link
Member

@victorjulien victorjulien left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Docs need some attention


ftpdata_command
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is this removed?

doc/userguide/rules/ftp-keywords.rst Show resolved Hide resolved
doc/userguide/rules/ftp-keywords.rst Show resolved Hide resolved
doc/userguide/upgrade.rst Show resolved Hide resolved
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 24314

@jlucovsky
Copy link
Contributor Author

Continued in #12457

@jlucovsky jlucovsky closed this Jan 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants