diff --git a/CHANGES b/CHANGES index 9075752ca7..84f1076046 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.5-310 | 2017-09-21 09:10:21 -0700 + + * fix interaction of gridftp scripts with other thresholds. (Justin Azoff) + 2.5-307 | 2017-09-20 10:51:09 -0500 * BIT-1846: Updating broctl submodule to include fix for symlinking diff --git a/VERSION b/VERSION index 0c08066503..3f3f014028 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-307 +2.5-310 diff --git a/scripts/base/protocols/ftp/gridftp.bro b/scripts/base/protocols/ftp/gridftp.bro index 68be66d53a..38f6d8186c 100644 --- a/scripts/base/protocols/ftp/gridftp.bro +++ b/scripts/base/protocols/ftp/gridftp.bro @@ -75,6 +75,9 @@ event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is if ( threshold < size_threshold || "gridftp-data" in c$service || c$duration > max_time ) return; + if ( ! data_channel_initial_criteria(c) ) + return; + add c$service["gridftp-data"]; event GridFTP::data_channel_detected(c);