mirror of
https://github.com/OISF/suricata.git
synced 2026-10-11 22:09:53 +00:00
Philippe Antoine
52490b8c26
Ticket: 8659 If a client sends a SOTR/RETR command before doing a PASV/PORT command, ther server may reply 425 Use PORT or PASV first.\r\n and allow the client to continue sendinf other commands So, Suricata should not put the whole flow into error, it just sets an event, and continues to parse further
10 lines
941 B
Plaintext
10 lines
941 B
Plaintext
# FTP app-layer event rules
|
|
#
|
|
# SID range start: 2232000
|
|
|
|
alert ftp any any -> any any (msg:"SURICATA FTP Request command too long"; flow:to_server; app-layer-event:ftp.request_command_too_long; classtype:protocol-command-decode; sid:2232000; rev:1;)
|
|
alert ftp any any -> any any (msg:"SURICATA FTP Response command too long"; flow:to_client; app-layer-event:ftp.response_command_too_long; classtype:protocol-command-decode; sid:2232001; rev:1;)
|
|
alert ftp any any -> any any (msg:"SURICATA FTP too many transactions"; app-layer-event:ftp.too_many_transactions; classtype:protocol-command-decode; sid:2232002; rev:1;)
|
|
alert ftp any any -> any any (msg:"SURICATA FTP file before port"; app-layer-event:ftp.file_before_port; classtype:protocol-command-decode; sid:2232003; rev:1;)
|
|
alert ftp any any -> any any (msg:"SURICATA FTP file without name"; app-layer-event:ftp.file_without_name; classtype:protocol-command-decode; sid:2232004; rev:1;)
|