Project

General

Profile

Actions

Bug #3728

closed

ftp file extraction failure

Added by xinfeng lee over 2 years ago. Updated 15 days ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
Affected Versions:
Effort:
medium
Difficulty:
medium
Label:
Protocol

Description

test:suricata -c suricata.yaml -r ftp.pcap.
when I use single thread,this question will not appear,but if I use workers runmodes and use multiple threads,it is easy to appear.
I see that code what is processing this,find that ftp_data app-layer is detected by ftp app-layer "AppLayerExpectationCreate" function。if ftp app-layer don't come at here,ftp_data is processed by another thread will not detected.because this function "AppLayerExpectationHandle" can't get ftp_data app-layer protocol.So,another thread can't correctly parse ftp_data packets.


Files

ftp-store-txt.pcapng (107 KB) ftp-store-txt.pcapng yida zhang, 03/03/2021 03:55 AM

Related issues 2 (0 open2 closed)

Related to Bug #5205: FTP-data unrecognized depending on multi-threadingClosedPhilippe AntoineActions
Related to Bug #4539: ftp-data protocol not detected in autofp runmodeClosedActions
Actions #1

Updated by xinfeng lee over 2 years ago

xinfeng lee wrote:

test:suricata -c suricata.yaml -r ftp.pcap.
when I use single thread,this question will not appear,but if I use pcap runmodes autofp or use multiple threads,it is easy to appear.
I see that code what is processing this,find that ftp_data app-layer is detected by ftp app-layer "AppLayerExpectationCreate" function。if ftp app-layer don't come at here,ftp_data is processed by another thread will not detected.because this function "AppLayerExpectationHandle" can't get ftp_data app-layer protocol.So,another thread can't correctly parse ftp_data packets.

Actions #2

Updated by Victor Julien about 2 years ago

  • Status changed from New to Feedback
  • Target version changed from 70 to TBD

An Suricata-Verify test case to show the issue would be great.

Actions #3

Updated by yida zhang over 1 year ago

Yes, here is a sample.

We are solving this problem. A plan has been realized, and the test results are good so far.

Actions #4

Updated by Victor Julien 5 months ago

  • Related to Bug #5205: FTP-data unrecognized depending on multi-threading added
Actions #5

Updated by Victor Julien 5 months ago

  • Related to Bug #4539: ftp-data protocol not detected in autofp runmode added
Actions #6

Updated by Philippe Antoine 15 days ago

  • Status changed from Feedback to Closed

Tracked in #5205

Actions

Also available in: Atom PDF