filestore: don't assume flow is TCP

Filestore can be used by UDP based protocols as well. NFSv2 is one
that Suricata supports.

Bug #3277.

diff --git a/src/detect-filestore.c b/src/detect-filestore.c
index a4bdc249d2bf8a33a6571c8e9a51881282d2a53b..c2d1340c22a96787a8b8bbb2a6a6856030b5c3cb 100644 (file)
--- a/src/detect-filestore.c
+++ b/src/detect-filestore.c
@@ -209,10 +209,11 @@ static int DetectFilestorePostMatch(DetectEngineThreadCtx *det_ctx,
 #endif
     }
 
-    /* set filestore depth for stream reassembling */
-    TcpSession *ssn = (TcpSession *)p->flow->protoctx;
-    TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth());
-
+    if (p->proto == IPPROTO_TCP && p->flow->protoctx != NULL) {
+        /* set filestore depth for stream reassembling */
+        TcpSession *ssn = (TcpSession *)p->flow->protoctx;
+        TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth());
+    }
     if (p->flowflags & FLOW_PKT_TOCLIENT)
         flags |= STREAM_TOCLIENT;
     else