From: Sreeja Athirkandathil Narayanan (sathirka) Date: Wed, 20 Jul 2022 20:47:45 +0000 (+0000) Subject: Pull request #3514: appid: send more packets to third-party for FTP user name extraction X-Git-Tag: 3.1.38.0~13 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0f0522be394a41acbdd3615946c1e02c9c9403a4;p=thirdparty%2Fsnort3.git Pull request #3514: appid: send more packets to third-party for FTP user name extraction Merge in SNORT/snort3 from ~BSACHDEV/snort3:ftp_uname to master Squashed commit of the following: commit e6475795888c007ad66de2985bfc6fbef482561d Author: bsachdev Date: Mon Jul 11 16:51:50 2022 -0400 appid: send more packets to third-party for FTP user name extraction --- diff --git a/src/network_inspectors/appid/tp_appid_types.h b/src/network_inspectors/appid/tp_appid_types.h index cb2eef427..4baa115b1 100644 --- a/src/network_inspectors/appid/tp_appid_types.h +++ b/src/network_inspectors/appid/tp_appid_types.h @@ -54,6 +54,7 @@ enum TPSessionAttr TP_ATTR_COPY_RESPONSE_CONTENT = (1 << 1), TP_ATTR_COPY_RESPONSE_LOCATION = (1 << 2), TP_ATTR_COPY_RESPONSE_BODY = (1 << 3), + TP_ATTR_UNAME_KNOWN = (1 << 4), }; static void set_attr(string*& attr, const char* buf, size_t len, bool flush, size_t max_len) diff --git a/src/network_inspectors/appid/tp_appid_utils.cc b/src/network_inspectors/appid/tp_appid_utils.cc index b75558180..9133bd81e 100644 --- a/src/network_inspectors/appid/tp_appid_utils.cc +++ b/src/network_inspectors/appid/tp_appid_utils.cc @@ -399,7 +399,11 @@ static inline void process_ftp_control(AppIdSession& asd, { asd.set_client_user(APP_ID_FTP_CONTROL, field->c_str(), change_bits); asd.set_user_logged_in(); + asd.tpsession->set_attr(TP_ATTR_UNAME_KNOWN); } + // This is a safe bail out condition in case username is not known + if ((asd.init_tpPackets + asd.resp_tpPackets) >= asd.get_odp_ctxt().max_tp_flow_depth) + asd.tpsession->set_attr(TP_ATTR_UNAME_KNOWN); } static inline void process_quic(AppIdSession& asd,