From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 16 Mar 2020 13:48:40 +0000 (+0100)
Subject: ftp: FTPGetAlstateProgress for done port commands
X-Git-Tag: suricata-6.0.0-beta1~487
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f36403219687b1bbcb667078a57c1c9d4aed185;p=thirdparty%2Fsuricata.git

ftp: FTPGetAlstateProgress for done port commands

For a done transaction with command PORT,
we expect FTP_STATE_FINISHED
and we got FTP_STATE_PORT_DONE instead
which prevented logging of these transactions

We change the order of the evaluations to get the right result
---

diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c
index e294069b8e..2a9c191ecb 100644
--- a/src/app-layer-ftp.c
+++ b/src/app-layer-ftp.c
@@ -996,13 +996,13 @@ static int FTPGetAlstateProgress(void *vtx, uint8_t direction)
     SCLogDebug("tx %p", vtx);
     FTPTransaction *tx = vtx;
 
-    if (direction == STREAM_TOSERVER &&
-        tx->command_descriptor->command == FTP_COMMAND_PORT) {
-        return FTP_STATE_PORT_DONE;
-    }
-
-    if (!tx->done)
+    if (!tx->done) {
+        if (direction == STREAM_TOSERVER &&
+            tx->command_descriptor->command == FTP_COMMAND_PORT) {
+            return FTP_STATE_PORT_DONE;
+        }
         return FTP_STATE_IN_PROGRESS;
+    }
 
     return FTP_STATE_FINISHED;
 }