Pull request #3514: appid: send more packets to third-party for FTP user name extraction

Merge in SNORT/snort3 from ~BSACHDEV/snort3:ftp_uname to master

Squashed commit of the following:

commit e6475795888c007ad66de2985bfc6fbef482561d
Author: bsachdev <bsachdev@cisco.com>
Date:   Mon Jul 11 16:51:50 2022 -0400

    appid: send more packets to third-party for FTP user name extraction

diff --git a/src/network_inspectors/appid/tp_appid_types.h b/src/network_inspectors/appid/tp_appid_types.h
index cb2eef427410c02599484769d6b141496f9b6039..4baa115b19b0259f70606f06dbfd206af45fd76d 100644 (file)
--- a/src/network_inspectors/appid/tp_appid_types.h
+++ b/src/network_inspectors/appid/tp_appid_types.h
@@ -54,6 +54,7 @@ enum TPSessionAttr
     TP_ATTR_COPY_RESPONSE_CONTENT   = (1 << 1),
     TP_ATTR_COPY_RESPONSE_LOCATION  = (1 << 2),
     TP_ATTR_COPY_RESPONSE_BODY      = (1 << 3),
+    TP_ATTR_UNAME_KNOWN             = (1 << 4),
 };
 
 static void set_attr(string*& attr, const char* buf, size_t len, bool flush, size_t max_len)

diff --git a/src/network_inspectors/appid/tp_appid_utils.cc b/src/network_inspectors/appid/tp_appid_utils.cc
index b755581803bed1518591a39b39a1f0f2171f33ff..9133bd81e8417b217a38397bda8a9f9936461d7e 100644 (file)
--- a/src/network_inspectors/appid/tp_appid_utils.cc
+++ b/src/network_inspectors/appid/tp_appid_utils.cc
@@ -399,7 +399,11 @@ static inline void process_ftp_control(AppIdSession& asd,
     {
         asd.set_client_user(APP_ID_FTP_CONTROL, field->c_str(), change_bits);
         asd.set_user_logged_in();
+        asd.tpsession->set_attr(TP_ATTR_UNAME_KNOWN);
     }
+    // This is a safe bail out condition in case username is not known 
+    if ((asd.init_tpPackets + asd.resp_tpPackets) >= asd.get_odp_ctxt().max_tp_flow_depth)
+        asd.tpsession->set_attr(TP_ATTR_UNAME_KNOWN);
 }
 
 static inline void process_quic(AppIdSession& asd,