Commit graph

4 commits

Author SHA1 Message Date
Jon Siwek
d84f6e012c Fix various documentation, mostly related to file analysis.
- Fix examples/references in the file analysis how-to/usage doc.

- Add Broxygen-generated docs for file analyzer plugins.

- Break FTP::Info type declaration out in to its own file to get
  rid of some circular dependencies (between s/b/p/ftp/main and
  s/b/p/ftp/utils).
2013-07-29 16:15:37 -05:00
Jon Siwek
18f8427579 Change how "gridftp" gets added to service field of connection records.
In addition to checking for a finished SSL handshake over an FTP
connection, it now also requires that the SSL handshake occurs after
the FTP client requested AUTH GSSAPI, more specifically identifying the
characteristics of GridFTP control channels.

Addresses #891.
2012-10-17 12:09:12 -05:00
Robin Sommer
5e12a53ae5 Merge remote-tracking branch 'origin/topic/jsiwek/gridftp'
* origin/topic/jsiwek/gridftp:
  Add memory leak unit test for GridFTP.
  Enable GridFTP detection by default.  Track/log SSL client certs.
  Add analyzer for GSI mechanism of GSSAPI FTP AUTH method.
  Add an example of a GridFTP data channel detection script.
2012-10-12 10:43:16 -07:00
Jon Siwek
e34f6d9e3b Enable GridFTP detection by default. Track/log SSL client certs.
In the *service* field of connection records, GridFTP control channels
are labeled as "gridftp" and data channels as "gridftp-data".

Added *client_subject* and *client_issuer_subject* as &log'd fields to
SSL::Info record.  Also added *client_cert* and *client_cert_chain*
fields to track client cert chain.
2012-10-08 11:38:29 -05:00