Dcerpc fixes batch/v2 #12491
Closed
Dcerpc fixes batch/v2 #12491
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If alproto for the current direction was not detected but the opposite side was successfully detected, if the Pattern Matching and Pattern Probing on the flow was also successfully done and the current direction's alproto is still unknown, a decoder event is set to indicate that the protocol detection only happened in one direction. This event is set after having sent the current data to the applayer parser. Now, the respective applayer parser may or may not successfully parse the data. However, the alproto on flow is already set from the other direction so there will be a flow event generated by Suricata. In order to keep this consistent with the stats, also make sure to increment the flow counter when the decode event is set so that the flow counter is incremented irrespective of the parsing status reported by the applayer parser. This patch makes stats for several specific applayer flow count equal to the number of flow events logged for those specific applayer protocols. Bug 7238
TCP data can be presented to the protocol parser in any way e.g. one byte at a time, single complete PDU, fragmented PDU, multiple PDUs at once. A limit of 1MB can be easily reached in some of such scenarios. Remove the check that rejects data that is more than 1MB.
to make it available for logging.
Instead of own internal mechanism of buffering in case of fragmented data, use AppLayerResult::incomplete API to let the AppLayer Parser take care of it. This makes the memory use more efficient. Remove any unneeded variables and code with the introduction of this API. Ticket 5699
With the introduction of AppLayerResult::incomplete API, fragmented data is no longer handled fully in the dcerpc code. Given that these code paths are already covered by the following s-v tests, these tests can now be safely removed. - dce-gap-handling - dcerpc-dce-iface-* Ticket 5699
- remove unneeded variables - remove unnecessary tracking of bytes in state - modify calculations as indicated by failing tests
as it is now covered by the suricata-verify test dcerpc-request-http-response.
Frames of the following types have been added for toserver direction: 1. Pdu: The entire Protocol Data Unit 2. Hdr: Header of the request 3. Data: PDU data Feature 4904
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #12491 +/- ##
==========================================
- Coverage 80.55% 80.50% -0.06%
==========================================
Files 925 925
Lines 259303 258927 -376
==========================================
- Hits 208886 208440 -446
- Misses 50417 50487 +70
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
WARNING:
Pipeline 24389 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There's a chain of blockers in the merge of long open dcerpc work. This PR brings all the fixes together so it is easier to maintain the conflicts. Pulls together work done in:
Link to tickets:
SV_BRANCH=OISF/suricata-verify#2024
Previous PR: #12485
Changes since v1: