Project

General

Profile

Actions
Copy link

Bug #8966

closed
AB AB

ftp: incorrect reply logged on empty response message

Bug #8966: ftp: incorrect reply logged on empty response message

Added by Amir Boussejra 2 months ago. Updated 13 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Amir Boussejra
Target version:
9.0.0-beta1
Affected Versions:
8.0.6
Effort:
Difficulty:
Label:

Description

I have a pcap where the server answers QUIT with a status code and an empty message. The bytes on the wire are exactly 221 \r\n — three digit code, one space separator, zero-length message.

Suricata 8.0.6 logs that transaction as:

{"command": "QUIT", "reply": ["221"], "reply_received": "yes", "reply_truncated": false}

No completion_code, and the code itself ends up in reply. 7.0.13 on the same pcap logs completion_code: ["221"].

I have fix I will suggest in a dedicated MR

Subtasks 1 (0 open — 1 closed)

Bug #9159: ftp: incorrect reply logged on empty response message (8.0.x backport)ClosedJason IshActions

PA Updated by Philippe Antoine about 1 month ago Actions
Copy link
 #1

  • Status changed from New to In Review
  • Assignee set to Amir Boussejra
  • Target version changed from TBD to 9.0.0-beta1

PA Updated by Philippe Antoine 30 days ago Actions
Copy link
 #2

  • Status changed from In Review to Resolved

PA Updated by Philippe Antoine 29 days ago Actions
Copy link
 #3

  • Label Needs backport to 8.0 added

OT Updated by OISF Ticketbot 29 days ago Actions
Copy link
 #4

  • Subtask #9159 added

OT Updated by OISF Ticketbot 29 days ago Actions
Copy link
 #5

  • Label deleted (Needs backport to 8.0)

JI Updated by Jason Ish 15 days ago Actions
Copy link
 #6

  • Status changed from Resolved to Closed

SB Updated by Shivani Bhardwaj 13 days ago Actions
Copy link
 #7

  • Subject changed from ftp: completion_code missing and code logged as reply when the response message is empty in to ftp: incorrect reply logged on empty response message
Actions
Copy link

Also available in: PDF Atom