From 746fb50d58c5adc5668f15537469d6dda9e7ba4d Mon Sep 17 00:00:00 2001
From: Cole Dishington <Cole.Dishington@alliedtelesis.co.nz>
Date: Mon, 15 May 2023 08:03:23 +1200
Subject: [PATCH] detect: Fix FTP bounce detection IP address comparison

Fix the FTP bounce IP address comparison by only converting the IP
parsed from the FTP payload to network order.

Bug: #6087
---
 src/detect-ftpbounce.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/detect-ftpbounce.c b/src/detect-ftpbounce.c
index b9134b11cb..318f72cf3b 100644
--- a/src/detect-ftpbounce.c
+++ b/src/detect-ftpbounce.c
@@ -141,7 +141,7 @@ static int DetectFtpbounceMatchArgs(
             }
             if (noctet == 4) {
                 /* Different IP than src, ftp bounce scan */
-                ip = SCByteSwap32(ip);
+                ip = SCNtohl(ip);
 
                 if (ip != ip_orig) {
                     SCLogDebug("Different ip, so Matched ip:%d <-> ip_orig:%d",