diff --git a/CHANGES b/CHANGES index 80e04551d8..e051516cd9 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,18 @@ +2.1-80 | 2012-10-19 14:48:42 -0700 + + * Change how "gridftp" gets added to service field of connection + records. In addition to checking for a finished SSL handshake over + an FTP connection, it now also requires that the SSL handshake + occurs after the FTP client requested AUTH GSSAPI, more + specifically identifying the characteristics of GridFTP control + channels. Addresses #891. (Jon Siwek) + + * Allow faster rebuilds in certain cases. Previously, when + rebuilding with a different "--prefix" or "--scriptdir", all Bro + source files were recompiled. With this change, only util.cc is + recompiled. (Daniel Thayer) + 2.1-76 | 2012-10-12 10:32:39 -0700 * Add support for recognizing GridFTP connections as an extension to diff --git a/VERSION b/VERSION index 2d2c497eeb..91171a8103 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.1-76 +2.1-80 diff --git a/scripts/base/protocols/ftp/gridftp.bro b/scripts/base/protocols/ftp/gridftp.bro index 7413fa24c6..57752b1cbd 100644 --- a/scripts/base/protocols/ftp/gridftp.bro +++ b/scripts/base/protocols/ftp/gridftp.bro @@ -68,6 +68,16 @@ export { const data_channel_initial_criteria: function(c: connection): bool &redef; } +redef record FTP::Info += { + last_auth_requested: string &optional; +}; + +event ftp_request(c: connection, command: string, arg: string) &priority=4 + { + if ( command == "AUTH" && c?$ftp ) + c$ftp$last_auth_requested = arg; + } + function size_callback(c: connection, cnt: count): interval { if ( c$orig$size > size_threshold || c$resp$size > size_threshold ) @@ -89,8 +99,10 @@ function size_callback(c: connection, cnt: count): interval event ssl_established(c: connection) &priority=5 { - # Add service label to control channels. - if ( "FTP" in c$service ) + # If an FTP client requests AUTH GSSAPI and later an SSL handshake + # finishes, it's likely a GridFTP control channel, so add service label. + if ( c?$ftp && c$ftp?$last_auth_requested && + /GSSAPI/ in c$ftp$last_auth_requested ) add c$service["gridftp"]; }