Merge pull request #2558 in SNORT/snort3 from ~SBAIGAL/snort3:ftps_fix_datach to...

Squashed commit of the following:

commit 1afc79c97017e8d5b26ced00f6c4e868a4669066
Author: Steven Baigal (sbaigal) <sbaigal@cisco.com>
Date:   Mon Oct 19 15:05:31 2020 -0400

    ftp_data: add can_start_tls() support and generate ssl search abandoned event for unencrypted data channels

diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc
index 6543ac91d676e424a54fda7f304ab272024acda5..f00f84c9a8b710c0a8efc771c4c536a1cb09a46c 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp_data.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_data.cc
@@ -232,7 +232,9 @@ void FtpDataFlowData::handle_expected(Packet* p)
         {
             OpportunisticTlsEvent evt(p, fd_svc_name);
             DataBus::publish(OPPORTUNISTIC_TLS_EVENT, evt, p->flow);
-        }   
+        }
+        else
+            DataBus::publish(SSL_SEARCH_ABANDONED, p);
     }
 }
 
@@ -262,6 +264,9 @@ public:
 
     bool can_carve_files() const override
     { return true; }
+
+    bool can_start_tls() const override
+    { return true; }
 };
 
 class FtpDataModule : public Module