https://redmine.openinfosecfoundation.org/https://redmine.openinfosecfoundation.org/favicon.ico?17011170022020-05-28T01:34:33ZOpen Information Security FoundationSuricata - Bug #3728: ftp file extraction failurehttps://redmine.openinfosecfoundation.org/issues/3728?journal_id=165132020-05-28T01:34:33Zxinfeng lee
<ul></ul><p>xinfeng lee wrote:</p>
<blockquote>
<p>test:suricata -c suricata.yaml -r ftp.pcap.<br />when I use single thread,this question will not appear,but if I use pcap runmodes autofp or use multiple threads,it is easy to appear.<br />I see that code what is processing this,find that ftp_data app-layer is detected by ftp app-layer "AppLayerExpectationCreate" function。if ftp app-layer don't come at here,ftp_data is processed by another thread will not detected.because this function "AppLayerExpectationHandle" can't get ftp_data app-layer protocol.So,another thread can't correctly parse ftp_data packets.</p>
</blockquote> Suricata - Bug #3728: ftp file extraction failurehttps://redmine.openinfosecfoundation.org/issues/3728?journal_id=171542020-08-07T14:09:21ZVictor Julienvictor@inliniac.net
<ul><li><strong>Status</strong> changed from <i>New</i> to <i>Feedback</i></li><li><strong>Target version</strong> changed from <i>70</i> to <i>TBD</i></li></ul><p>An Suricata-Verify test case to show the issue would be great.</p> Suricata - Bug #3728: ftp file extraction failurehttps://redmine.openinfosecfoundation.org/issues/3728?journal_id=194972021-03-03T03:57:57Zyida zhang
<ul><li><strong>File</strong> <a href="/attachments/2270">ftp-store-txt.pcapng</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/2270/ftp-store-txt.pcapng">ftp-store-txt.pcapng</a> added</li></ul><p>Yes, here is a sample.</p>
<p>We are solving this problem. A plan has been realized, and the test results are good so far.</p> Suricata - Bug #3728: ftp file extraction failurehttps://redmine.openinfosecfoundation.org/issues/3728?journal_id=233082022-05-01T06:28:21ZVictor Julienvictor@inliniac.net
<ul><li><strong>Related to</strong> <i><a class="issue tracker-1 status-5 priority-4 priority-default closed" href="/issues/5205">Bug #5205</a>: FTP-data unrecognized depending on multi-threading</i> added</li></ul> Suricata - Bug #3728: ftp file extraction failurehttps://redmine.openinfosecfoundation.org/issues/3728?journal_id=233102022-05-01T06:28:29ZVictor Julienvictor@inliniac.net
<ul><li><strong>Related to</strong> <i><a class="issue tracker-1 status-5 priority-4 priority-default closed" href="/issues/4539">Bug #4539</a>: ftp-data protocol not detected in autofp runmode</i> added</li></ul> Suricata - Bug #3728: ftp file extraction failurehttps://redmine.openinfosecfoundation.org/issues/3728?journal_id=244832022-09-14T08:28:11ZPhilippe Antoine
<ul><li><strong>Status</strong> changed from <i>Feedback</i> to <i>Closed</i></li></ul><p>Tracked in <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Bug: FTP-data unrecognized depending on multi-threading (Closed)" href="https://redmine.openinfosecfoundation.org/issues/5205">#5205</a></p>