Merge pull request #2121 in SNORT/snort3 from ~SATHIRKA/snort3:ftp_data_smtp_whitelis...

Squashed commit of the following:

commit 344a0e0c70ac76761a2ec02af9af893152a053dc
Author: Sreeja Athirkandathil Narayanan <sathirka@cisco.com>
Date:   Tue Mar 31 11:39:00 2020 -0400

    appid: mark third-party inspection as done for expected flows

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index 1d29b5e7e06b5a270a33d2c75e4dc9c1c8c2c9b7..edaf6887e5cd8f9c48e053a8abca7ad8b612b8a2 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -918,6 +918,9 @@ bool AppIdSession::is_tp_appid_done() const
 {
     if (ctxt.get_tp_appid_ctxt())
     {
+        if (get_session_flags(APPID_SESSION_IGNORE_FLOW))
+            return true;
+
         if (!tpsession)
             return false;
 

diff --git a/src/network_inspectors/appid/detector_plugins/detector_smtp.cc b/src/network_inspectors/appid/detector_plugins/detector_smtp.cc
index 5c819d010259c25ec4125f96774a229b3b5f87c9..597035064f22b0c4c1322c82ae755f5c6a2b1c35 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_smtp.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_smtp.cc
@@ -89,7 +89,9 @@ struct SMTPDetectorData
 };
 
 #define HELO "HELO "
+#define helo "helo "
 #define EHLO "EHLO "
+#define ehlo "ehlo "
 #define MAILFROM "MAIL FROM:"
 #define RCPTTO "RCPT TO:"
 #define DATA "DATA"
@@ -137,7 +139,9 @@ SmtpClientDetector::SmtpClientDetector(ClientDiscovery* cdm)
     tcp_patterns =
     {
         { (const uint8_t*)HELO, sizeof(HELO)-1, -1, 0, APP_ID_SMTP },
+        { (const uint8_t*)helo, sizeof(helo)-1, -1, 0, APP_ID_SMTP },
         { (const uint8_t*)EHLO, sizeof(EHLO)-1, -1, 0, APP_ID_SMTP },
+        { (const uint8_t*)ehlo, sizeof(ehlo)-1, -1, 0, APP_ID_SMTP },
         { APP_SMTP_OUTLOOK,         sizeof(APP_SMTP_OUTLOOK)-1,        -1, 0, APP_ID_OUTLOOK },
         { APP_SMTP_OUTLOOK_EXPRESS, sizeof(APP_SMTP_OUTLOOK_EXPRESS)-1,-1, 0, APP_ID_OUTLOOK_EXPRESS },
         { APP_SMTP_IMO,             sizeof(APP_SMTP_IMO)-1,            -1, 0, APP_ID_SMTP_IMO },