]> git.ipfire.org Git - thirdparty/snort3.git/commitdiff
Pull request #4939: appid: ignore arcserve so dcerpc protocol is used when syncing...
authorAndres Avila Segura (aavilase) <aavilase@cisco.com>
Tue, 14 Oct 2025 21:21:05 +0000 (21:21 +0000)
committerChris Sherwin (chsherwi) <chsherwi@cisco.com>
Tue, 14 Oct 2025 21:21:05 +0000 (21:21 +0000)
Merge in SNORT/snort3 from ~AAVILASE/snort3:arcserve_dcerpc_intrusion_fix to master

Squashed commit of the following:

commit f183fca9b4fff875c7ab8b75096340408b5db2a1
Author: Andres Avila <aavilase@cisco.com>
Date:   Mon Oct 13 20:37:56 2025 -0400

    appid: ignore arcserve so dcerpc protocol is used when syncing to flow service

src/network_inspectors/appid/appid_session.cc

index d441dec1d7e426506036867a8a198aac022c30b0..2d0ed9f0dbf8717a0e58e948244d5934c61bbdc0 100644 (file)
@@ -361,6 +361,8 @@ void AppIdSession::sync_with_snort_protocol_id(AppId newAppId, Packet* p, AppidC
     case APP_ID_FTPS:
     case APP_ID_FTPSDATA:
 
+    case APP_ID_ARCSERVE:
+
     // These all are variants of HTTPS
     case APP_ID_DDM_SSL:
     case APP_ID_MSFT_GC_SSL: