From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Sat, 15 Jun 2019 14:03:23 +0000 (-0400)
Subject: ftp: Generalize prelim positive reply
X-Git-Tag: suricata-5.0.0-rc1~185
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=911d423a6bcc70deb8b06fc7b2811a7e078e0fc2;p=thirdparty%2Fsuricata.git

ftp: Generalize prelim positive reply

Extend special case for reply code 150 to handle all preliminary
positive reply -- reply codes with `1xy`.
---

diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c
index bc8323afd8..05a2bd65d5 100644
--- a/src/app-layer-ftp.c
+++ b/src/app-layer-ftp.c
@@ -824,7 +824,8 @@ static int FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstat
         }
     }
 
-    if (input_len >= 4 && SCMemcmp("150 ", input, 4) == 0) {
+    /* Handle preliminary replies -- keep tx open */
+    if (FTPIsPPR(input, input_len)) {
         return retcode;
     }
 
@@ -833,6 +834,7 @@ tx_complete:
     return retcode;
 }
 
+
 #ifdef DEBUG
 static SCMutex ftp_state_mem_lock = SCMUTEX_INITIALIZER;
 static uint64_t ftp_state_memuse = 0;