From: Victor Julien <victor@inliniac.net>
Date: Thu, 24 Oct 2019 12:51:48 +0000 (+0200)
Subject: filestore: don't assume flow is TCP
X-Git-Tag: suricata-4.1.6~76
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F4370%2Fhead;p=thirdparty%2Fsuricata.git

filestore: don't assume flow is TCP

Filestore can be used by UDP based protocols as well. NFSv2 is one
that Suricata supports.

Bug #3278.

(cherry picked from commit 0824b0413455b668777e83cabe9fbc0ea81c400a)
---

diff --git a/src/detect-filestore.c b/src/detect-filestore.c
index b001537cb5..b9c3f7692c 100644
--- a/src/detect-filestore.c
+++ b/src/detect-filestore.c
@@ -202,10 +202,11 @@ int DetectFilestorePostMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Pack
 #endif
     }
 
-    /* set filestore depth for stream reassembling */
-    TcpSession *ssn = (TcpSession *)p->flow->protoctx;
-    TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth());
-
+    if (p->proto == IPPROTO_TCP && p->flow->protoctx != NULL) {
+        /* set filestore depth for stream reassembling */
+        TcpSession *ssn = (TcpSession *)p->flow->protoctx;
+        TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth());
+    }
     if (p->flowflags & FLOW_PKT_TOCLIENT)
         flags |= STREAM_TOCLIENT;
     else