Merge pull request #2772 in SNORT/snort3 from ~DERAMADA/snort3:ftp_held_pkt_detection...

Squashed commit of the following:

commit 26c02c56d90d25bcbd9b8e62e1dcf0e12ca991df
Author: Deepak Ramadass <deramada@cisco.com>
Date:   Thu Feb 25 11:04:05 2021 -0500

    stream: set block pending flag when a flow is dropped

commit dd01cd19943517c5dcada77d82c3079dd20a2c64
Author: Deepak Ramadass <deramada@cisco.com>
Date:   Thu Feb 25 11:03:02 2021 -0500

    ftp_telnet: implement init_partial_flush for ftp data

diff --git a/src/service_inspectors/ftp_telnet/ftpdata_splitter.h b/src/service_inspectors/ftp_telnet/ftpdata_splitter.h
index 83aa87f1a9f0016b89defa010aaf4adbf07c9799..755667d309592949c7c4385b611195c2f9421eda 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftpdata_splitter.h
+++ b/src/service_inspectors/ftp_telnet/ftpdata_splitter.h
@@ -38,6 +38,7 @@ public:
 
     Status scan(snort::Packet*, const uint8_t*, uint32_t len, uint32_t flags, uint32_t* fp ) override;
     bool finish(snort::Flow*) override;
+    bool init_partial_flush(snort::Flow*) override { return true; }
 
     bool is_paf() override
     { return true; }

diff --git a/src/stream/stream.cc b/src/stream/stream.cc
index 131b21ef5a94fe922d2516d8c34bbb297c82a4a0..5e8ccfb7eb80e0f8137d51e59be309502630c643 100644 (file)
--- a/src/stream/stream.cc
+++ b/src/stream/stream.cc
@@ -356,6 +356,7 @@ void Stream::drop_flow(const Packet* p)
     if (!flow)
         return;
 
+    flow->session_state |= STREAM_STATE_BLOCK_PENDING;
     flow->session->clear();
     flow->set_state(Flow::FlowState::BLOCK);