Project

General

Profile

Optimization #3077

FTP parser command lookup

Added by Jeff Lucovsky 14 days ago. Updated 3 days ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

The FTP parser should use mpm when looking for commands instead of performing a linear search over the command coordinates with squashed case.


Related issues

Related to Feature #2315: eve: ftp loggingClosedActions

History

#1

Updated by Victor Julien 12 days ago

  • Status changed from New to Assigned
  • Assignee set to Jeff Lucovsky
  • Target version set to Soon
  • Effort deleted (low)
#2

Updated by Philippe Antoine 3 days ago

#3

Updated by Jeff Lucovsky 3 days ago

Also, address this comment from the FTP logging PR https://github.com/OISF/suricata/pull/3967#discussion_r302236153

" Ok. but then could output-json-ftp.c call some new parsing function in app-layer-ftp.c ?
This way, we will defer parsing until needed and the parsing will be in app-*.c files"

Also available in: Atom PDF