Skip to content

Commit 934ec89

Browse files
committed
ftpdata: ignore direction in ftpdata_command
The ftpdata_command would never match a RETR in the to_server direction, or a STOR in the to_client direction, this effectively makes the ftpdata_command applicable to passive mode only. Instead, remove the directionality on the ftpdata_command. Its "meta" information passed from the control channel and isn't really directional. I think the idea was to abstract away active/passive from the rule writer, but unfortunately doesn't allow the ftpdata_command keyword to work in the more strict firewll mode.
1 parent 1614df0 commit 934ec89

1 file changed

Lines changed: 1 addition & 11 deletions

File tree

src/detect-ftpdata.c

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -105,17 +105,7 @@ static int DetectFtpdataMatch(DetectEngineThreadCtx *det_ctx,
105105
if (ftp_state == NULL)
106106
return 0;
107107

108-
if (ftpcommandd->command == ftp_state->command) {
109-
/* Only match if the flow is in the good direction */
110-
if ((flags & STREAM_TOSERVER) && (ftpcommandd->command == FTP_COMMAND_RETR)) {
111-
return 0;
112-
} else if ((flags & STREAM_TOCLIENT) && (ftpcommandd->command == FTP_COMMAND_STOR)) {
113-
return 0;
114-
}
115-
return 1;
116-
}
117-
118-
return 0;
108+
return ftpcommandd->command == ftp_state->command;
119109
}
120110

121111
/**

0 commit comments

Comments
 (0)