Actions
Bug #8966
open
AB
AB
ftp: completion_code missing and code logged as reply when the response message is empty in
Bug #8966:
ftp: completion_code missing and code logged as reply when the response message is empty in
Affected Versions:
Effort:
Difficulty:
Label:
Description
I have a pcap where the server answers QUIT with a status code and an empty message. The bytes on the wire are exactly 221 \r\n — three digit code, one space separator, zero-length message.
Suricata 8.0.6 logs that transaction as:
{"command": "QUIT", "reply": ["221"], "reply_received": "yes", "reply_truncated": false}
No completion_code, and the code itself ends up in reply. 7.0.13 on the same pcap logs completion_code: ["221"].
I have fix I will suggest in a dedicated MR
PA Updated by Philippe Antoine 23 days ago
- Status changed from New to In Review
- Assignee set to Amir Boussejra
- Target version changed from TBD to 9.0.0-beta1
PA Updated by Philippe Antoine 9 days ago
- Status changed from In Review to Resolved
PA Updated by Philippe Antoine 8 days ago
- Label Needs backport to 8.0 added
OT Updated by OISF Ticketbot 8 days ago
- Subtask #9159 added
OT Updated by OISF Ticketbot 8 days ago
- Label deleted (
Needs backport to 8.0)
Actions