app-layer-ftp: detect FTP alproto when using AUTH TLS

Try to detect FTP using the patterns '220 (' and 'FEAT', since 'USER '
and 'PASS ' are not sent in cleartext when using AUTH TLS.
pull/2693/head
Mats Klepsland 9 years ago committed by Victor Julien
parent 74aa65073b
commit 8125f78f5f

@ -379,6 +379,16 @@ static int FTPGetAlstateProgress(void *tx, uint8_t direction)
static int FTPRegisterPatternsForProtocolDetection(void)
{
if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_FTP,
"220 (", 5, 0, STREAM_TOCLIENT) < 0)
{
return -1;
}
if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_FTP,
"FEAT", 4, 0, STREAM_TOSERVER) < 0)
{
return -1;
}
if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_FTP,
"USER ", 5, 0, STREAM_TOSERVER) < 0)
{

Loading…
Cancel
Save