[Snort-devel] Bug in src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c

Russ Combs rcombs at ...402...
Thu Sep 12 11:09:33 EDT 2013


Hi.  That code looks correct w/o patching.  strncasecmp(a,b) returns zero
if a matches b.

I'm not clear on the issue that you are having.  What is your ftp
configuration and what are you trying to do?

Let me know and we'll try to get it figured out.

Thanks
Russ



On Thu, Sep 12, 2013 at 3:30 AM, Reinoud Koornstra <sockstat at ...445...>wrote:

> Hi Everyone,
>
> I've been struggeling with trying to get trying to active this option
> Identify open data channels.
> Even with the parameter ignore_data_chan no, it wouldn't activate.
> After some instrumentation I found that we were turning it off because of
> a comparison that didn't go right.
> Even with ignore_data_chan set to no, we'd still come in the else if which
> wasn't correct.
> Here's a fix to the problem:
>
> ---- src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c.orig 2013-09-12
> 00:17:29.301433818 -0700
> +++ src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c 2013-09-12
> 00:21:54.441437865 -0700
> @@ -1403,11 +1403,11 @@
>                                           confOption);
>          return FTPP_FATAL_ERR;
>      }
> -    if (!strcasecmp("yes", pcToken))
> +    if (strncmp("yes", pcToken, 3) != 0)
>      {
>          ServerConf->data_chan = 1;
>      }
> -    else if (!strcasecmp("no", pcToken))
> +    else if (strncmp("no", pcToken, 2) != 0)
>      {
>          if (ServerConf->data_chan == 1)
>          {
>
> Thanks,
>
> Reinoud.
>
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130912/e583e421/attachment.html>


More information about the Snort-devel mailing list