ftpdata: ignore direction in ftpdata_command

The ftpdata_command would never match a RETR in the to_server direction,
or a STOR in the to_client direction, this effectively makes the
ftpdata_command applicable to passive mode only.

Instead, remove the directionality on the ftpdata_command. Its "meta"
information passed from the control channel and isn't really
directional. I think the idea was to abstract away active/passive from
the rule writer, but unfortunately doesn't allow the ftpdata_command
keyword to work in the more strict firewll mode.

Ticket: #8663
(cherry picked from commit 2fe4bb2872)
pull/15709/head
Jason Ish 4 months ago committed by Victor Julien
parent dace9ecc45
commit f2ef8e0805

@ -105,17 +105,7 @@ static int DetectFtpdataMatch(DetectEngineThreadCtx *det_ctx,
if (ftp_state == NULL)
return 0;
if (ftpcommandd->command == ftp_state->command) {
/* Only match if the flow is in the good direction */
if ((flags & STREAM_TOSERVER) && (ftpcommandd->command == FTP_COMMAND_RETR)) {
return 0;
} else if ((flags & STREAM_TOCLIENT) && (ftpcommandd->command == FTP_COMMAND_STOR)) {
return 0;
}
return 1;
}
return 0;
return ftpcommandd->command == ftp_state->command;
}
/**

Loading…
Cancel
Save