protocol-change: sets event in case of failure #7296
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Protocol change can fail if one protocol change is already occuring.
Codecov Report
@@ Coverage Diff @@
## master #7296 +/- ##
==========================================
- Coverage 75.82% 75.77% -0.05%
==========================================
Files 656 656
Lines 190051 190057 +6
==========================================
- Hits 144102 144020 -82
- Misses 45949 46037 +88
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Victor, you requested this event, so assigning this draft to you ;-) |
|
Information: ERROR: QA failed on tlpw1_files_sha256.
Pipeline 7251 |
victorjulien
reviewed
May 3, 2022
| @@ -87,4 +87,6 @@ alert http any any -> any any (msg:"SURICATA HTTP invalid Range header value"; f | |||
|
|
|||
| alert http any any -> any any (msg:"SURICATA HTTP file name too long"; flow:established; app-layer-event:http.file_name_too_long; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221052; rev:1;) | |||
|
|
|||
| # next sid 2221053 | |||
| alert http any any -> any any (msg:"SURICATA HTTP failed protocol change"; flow:established; app-layer-event:http.failed_protocol_change; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221053; rev:1;) | |||
There was a problem hiding this comment.
is there any case where this isn't about a HTTPS upgrade?
victorjulien
reviewed
May 3, 2022
| @@ -30,4 +30,5 @@ alert smtp any any -> any any (msg:"SURICATA SMTP Mime boundary length exceeded" | |||
| alert smtp any any -> any any (msg:"SURICATA SMTP duplicate fields"; flow:established,to_server; app-layer-event:smtp.duplicate_fields; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220018; rev:1;) | |||
| alert smtp any any -> any any (msg:"SURICATA SMTP unparsable content"; flow:established,to_server; app-layer-event:smtp.unparsable_content; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220019; rev:1;) | |||
| alert smtp any any -> any any (msg:"SURICATA SMTP filename truncated"; flow:established,to_server; app-layer-event:smtp.mime_long_filename; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220020; rev:1;) | |||
| # next sid 2220021 | |||
| alert smtp any any -> any any (msg:"SURICATA SMTP failed protocol change"; flow:established; app-layer-event:smtp.failed_protocol_change; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220021; rev:1;) | |||
There was a problem hiding this comment.
this is always about STARTTLS, right?
|
Are there pcaps to test this scenario? If not can you craft them? |
|
Replaced by #7745 with S-V test linked ;-) |
catenacyber
added a commit
to catenacyber/suricata
that referenced
this pull request
Oct 3, 2024
So as to avoid undefined behavior with a 0-sized variable length array Ticket: OISF#7296
catenacyber
added a commit
to catenacyber/suricata
that referenced
this pull request
Oct 3, 2024
So as to avoid undefined behavior with a 0-sized variable length array Ticket: OISF#7296
victorjulien
pushed a commit
to victorjulien/suricata
that referenced
this pull request
Oct 8, 2024
So as to avoid undefined behavior with a 0-sized variable length array Ticket: OISF#7296
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Link to redmine ticket:
None
Describe changes:
Another way to do this would be to set a packet's app-layer event, but
AppLayerRequestProtocolChangedoes not have access to the currentPacketand its callerFTPParseResponsedoes not have it neither...So, this PR implements different events for the different app-layer protocols.
FTP and PGSQL do not have events yet, and are not part of this...