From edca837fea3fa114519027413f3feef4c48d8f8d Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 24 Oct 2019 14:51:48 +0200 Subject: [PATCH] filestore: don't assume flow is TCP Filestore can be used by UDP based protocols as well. NFSv2 is one that Suricata supports. Bug #3278. (cherry picked from commit 0824b0413455b668777e83cabe9fbc0ea81c400a) --- src/detect-filestore.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/detect-filestore.c b/src/detect-filestore.c index b001537cb5..b9c3f7692c 100644 --- a/src/detect-filestore.c +++ b/src/detect-filestore.c @@ -202,10 +202,11 @@ int DetectFilestorePostMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Pack #endif } - /* set filestore depth for stream reassembling */ - TcpSession *ssn = (TcpSession *)p->flow->protoctx; - TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth()); - + if (p->proto == IPPROTO_TCP && p->flow->protoctx != NULL) { + /* set filestore depth for stream reassembling */ + TcpSession *ssn = (TcpSession *)p->flow->protoctx; + TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth()); + } if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= STREAM_TOCLIENT; else -- 2.47.2