]> git.ipfire.org Git - thirdparty/suricata.git/commit
projects / thirdparty / suricata.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7cd0d00) | patch
ftp: do not set alproto if one was already found 7028/head
authorPhilippe Antoine <contact@catenacyber.fr>
Mon, 29 Nov 2021 09:59:10 +0000 (10:59 +0100)
committerJeff Lucovsky <jeff@lucovsky.org>
Tue, 8 Feb 2022 15:30:32 +0000 (10:30 -0500)
commit69ea47dc715d5182cd63eadff92868f72ab03e05
treec8182dd969814ea6e19d012b04553ab5c838a3c1tree
parent7cd0d00fdc1e9c1a6b4049379f23b5fa3b368a04commit | diff
ftp: do not set alproto if one was already found

Ticket: 4857

If a pattern such as GET is seen ine the beginning of the
file transferred over ftp-data, this flow will get recognized
as HTTP, and a HTTP state will be created during parsing.

Thus, we cannot override directly alproto's values

This solves the segfault, but not the logical bug that the flow
should be classified as FTP-DATA instead of HTTP

(cherry picked from commit dd32238667f08c7211ae4fa27cfe43af7cffd52d)
src/app-layer-expectation.c diff | blob | blame | history
Mirror of https://github.com/OISF/suricata.git