Actions
Bug #3650
closedFTP response buffering against TCP stream
Affected Versions:
Effort:
Difficulty:
Label:
Description
Now, Suricata parses FTP response packets as if they are always complete.
This is not the TCP logic of streaming.
We have to keep buffering until the response is complete, and we can parse multiple responses in one TCP stream in one time.
Found by running suricata-verify tests while doing TCP stream splitting
Fix proposed https://github.com/OISF/suricata/pull/4789
Actions