From 34d7f0c65d2d59551c79f52d186ea41d888267ae Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sat, 26 Apr 2025 09:21:51 -0400 Subject: [PATCH] output/ftp: Log mode for passive connections This commit will now output the FTP mode -- active or passive -- when the command is - (previous): PORT, EPRT - (new): PASV, EPSV Issue: 7505 --- src/output-json-ftp.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/src/output-json-ftp.c b/src/output-json-ftp.c index 0f2f23575a..e41d506f8e 100644 --- a/src/output-json-ftp.c +++ b/src/output-json-ftp.c @@ -128,13 +128,18 @@ bool EveFTPLogCommand(void *vtx, SCJsonBuilder *jb) SCJbSetUint(jb, "dynamic_port", tx->dyn_port); } - if (tx->command_descriptor.command_code == FTP_COMMAND_PORT || - tx->command_descriptor.command_code == FTP_COMMAND_EPRT) { - if (tx->active) { - JB_SET_STRING(jb, "mode", "active"); - } else { - JB_SET_STRING(jb, "mode", "passive"); - } + switch (tx->command_descriptor.command_code) { + case FTP_COMMAND_PORT: + case FTP_COMMAND_EPRT: + case FTP_COMMAND_PASV: + case FTP_COMMAND_EPSV: + if (tx->active) { + JB_SET_STRING(jb, "mode", "active"); + } else { + JB_SET_STRING(jb, "mode", "passive"); + } + default: + break; } if (tx->done) { -- 2.47.2