ftp: don't match unset ftp.dynamic_port

Treat dyn_port 0 as an absent value so numeric comparisons do not
match FTP transactions without a negotiated data port.

Ticket: #8392
pull/15726/head
Jason Ish 1 month ago committed by Victor Julien
parent dd600d0860
commit e560db9d1f

@ -87,6 +87,8 @@ static int DetectFtpDynamicPortMatch(DetectEngineThreadCtx *det_ctx, Flow *f, ui
FTPTransaction *tx = (FTPTransaction *)txv;
if (tx->command_descriptor.command_code == FTP_COMMAND_UNKNOWN)
return 0;
if (tx->dyn_port == 0)
return 0;
const DetectU16Data *ftpd = (const DetectU16Data *)ctx;

Loading…
Cancel
Save