content match fails with on large streams
Using suricata 4.0.0-dev (rev 2eadd77e), I have encountered a weird behavior.
A large payload (+900 kB) cause suricata to fail content matching if the data stream does not end with it. If the stream does end with it, suricata logs it twice (in fast.log).
With a rule such as :
alert ip any any -> any any (msg:"my super-useful rule"; priority:1; rev:1; sid:42420003; content:"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";)
And payloads such as :
payload1 : "A" * 900000 + "B" * 150
payload2 : payload1 + "C" * 850
payload1 is detected (or at least logged) twice while payload2 is not detected at all.
.pcap files to reproduce described behavior can be found as attachments to this issue.
Updated by Andreas Herz about 3 years ago
- Status changed from New to Closed
Hi, we're closing this issue since there have been no further responses.
If you think this bug is still relevant, try to test it again with the
most recent version of suricata and reopen the issue. If you want to
improve the bug report please take a look at