doc: update following ftp-data changes

diff --git a/doc/userguide/file-extraction/file-extraction.rst b/doc/userguide/file-extraction/file-extraction.rst
index a85567bf427d62e69acb244d882148e2ca705c72..dd6d4843000ef3e213f242acb2250018e653ffab 100644 (file)
--- a/doc/userguide/file-extraction/file-extraction.rst
+++ b/doc/userguide/file-extraction/file-extraction.rst
@@ -4,9 +4,9 @@ File Extraction
 Architecture
 ~~~~~~~~~~~~
 
-The file extraction code works on top of the HTTP and SMTP parsers. The HTTP parser takes care of dechunking and unzipping the request and/or response data if necessary. The HTTP/SMTP parsers runs on top of the stream reassembly engine.
+The file extraction code works on top of the HTTP, SMTP, NFS and NTP parsers. The HTTP parser takes care of dechunking and unzipping the request and/or response data if necessary. The application layer parsers runs on top of the stream reassembly engine.
 
-This means that settings in the stream engine, reassembly engine and the HTTP parser all affect the workings of the file extraction.
+This means that settings in the stream engine, reassembly engine and the application layer parser all affect the workings of the file extraction.
 
 What files are actually extracted and stored to disk is controlled by the rule language.
 

diff --git a/doc/userguide/rules/ftp-keywords.rst b/doc/userguide/rules/ftp-keywords.rst
new file mode 100644 (file)
index 0000000..068b14e
--- /dev/null
+++ b/doc/userguide/rules/ftp-keywords.rst
@@ -0,0 +1,31 @@
+FTP/FTP-DATA Keywords
+=====================
+
+ftpdata_command
+---------------
+
+Filter ftp-data channel based on command used on the FTP command channel.
+Currently supported commands are RETR (get on a file) and STOR (put on a
+file).
+
+Syntax::
+
+  ftpdata_command:(retr|stor)
+
+Examples::
+
+  ftpdata_command:retr
+  ftpdata_command:stor
+
+Signature example::
+
+ alert ftp-data any any -> any any (msg:"FTP store password"; filestore; filename:"password"; ftpdata_command:stor; sid:3; rev:1;)
+
+ftpbounce
+---------
+
+Detect FTP bounce attacks.
+
+Syntax::
+
+  ftpbounce

diff --git a/doc/userguide/rules/index.rst b/doc/userguide/rules/index.rst
index 6ddc079d9b94bef6c30910841cb3be1a6c70eaf1..d7543ec2886cbdba0a48be3d506638bb5e67dac5 100644 (file)
--- a/doc/userguide/rules/index.rst
+++ b/doc/userguide/rules/index.rst
@@ -16,6 +16,7 @@ Suricata Rules
    modbus-keyword
    dnp3-keywords
    enip-keyword
+   ftp-keywords
    app-layer
    xbits
    thresholding