Merge pull request #2897 in SNORT/snort3 from ~VIGNVISW/snort3:vignvisw_CSCvy23818...

Squashed commit of the following:

commit b347ac156107b59a54a2779b4bbcf242eddda540
Author: Vigneshwari Viswanathan <vignvisw@cisco.com>
Date:   Tue May 18 07:06:46 2021 -0400

    ftp: creating additional expected session if negotiated ip is different from server IP on packet

diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc
index 68338bb6f8855af3317b8325336167df5fe49275..946213a0f491322aa85a1ca4a80854a7f3a35af6 100644 (file)
--- a/src/service_inspectors/ftp_telnet/pp_ftp.cc
+++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc
@@ -1114,6 +1114,31 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
                                     delete fd;
                                     session->datassn = nullptr;
                                 }
+
+                                if (!session->serverIP.equals(*p->ptrs.ip_api.get_src()))
+                                {
+                                    FtpDataFlowData* fd1 = new FtpDataFlowData(p);
+                                    FTP_DATA_SESSION* ftpdata1 = &fd1->session;
+
+                                    ftpdata1->mode = FTPP_XFER_PASSIVE;
+                                    ftpdata1->data_chan = session->server_conf->data_chan;
+
+                                    if (p->flow->flags.data_decrypted and
+                                        (session->flags & FTP_PROTP_CMD_ACCEPT))
+                                        fd1->in_tls = true;
+
+                                    result = Stream::set_snort_protocol_id_expected(
+                                        p, PktType::TCP, IpProtocol::TCP,
+                                        &session->clientIP, session->clientPort,
+                                        p->ptrs.ip_api.get_src(), session->serverPort,
+                                        ftp_data_snort_protocol_id, fd1);
+
+                                    if (result < 0)
+                                    {
+                                        delete fd1;
+                                        session->datassn = nullptr;
+                                    }
+                                }
                             }
                             else if (session->server_conf->data_chan)
                             {