Project

General

Profile

Actions

Bug #2836

closed

signature with filemagic do not honor flowbits

Added by Eric Leblond about 5 years ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
medium
Difficulty:
high
Label:

Description

When running the following ruleset on a pcap with a PDF transfer, we have an unexpected result with sid:2 and sid:3 alerting on the same packet even if they have opposed flowbits tests

alert http any any -> any any (msg:"Wget useragent";content:"wget"; nocase; http_user_agent; sid:1; rev:1; flowbits:set,wgetagent; noalert;)
alert http any any -> any any (msg:"PDF wget"; flowbits:isset,wgetagent; filemagic:"PDF"; flow:established,to_client; sid:2; rev:1;)
alert http any any -> any any (msg:"PDF not wget"; flowbits:isnotset,wgetagent; filemagic:"PDF"; flow:established,to_client; sid:3; rev:1;)

You can find suricata-verify test here: https://github.com/regit/suricata-verify/commits/filemagic

Suricata 3.2 was correct but Suricata 4.0.x was not. A git bisect on this range seems to show that the following patch is responsible of the issue:

commit 1bbf5553186c7d38b678f93db24773bd14ff84cf
Author: Victor Julien <victor@inliniac.net>
Date:   Tue Apr 11 15:24:49 2017 +0200

    detect: improve stateful detection


Related issues 2 (0 open2 closed)

Related to Suricata - Optimization #6194: detect: modernize filename fileext filemagicClosedVictor JulienActions
Related to Suricata - Optimization #6203: detect: modernize filename fileext filemagic (6.0.x backport)ClosedVictor JulienActions
Actions #1

Updated by Eric Leblond about 5 years ago

Actions #2

Updated by Andreas Herz about 5 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions #3

Updated by Philippe Antoine almost 3 years ago

  • Assignee changed from OISF Dev to Philippe Antoine
Actions #4

Updated by Philippe Antoine almost 3 years ago

S-V passes with using sticky buffer file.magic instead of filemagic

Actions #5

Updated by Philippe Antoine almost 3 years ago

DetectFlowbitMatch is called too early for sid 3 and the flow bit is not set yet, so it matches. even if we have no file yet
Then DetectFilemagicMatch is called later

So, there may a deep issue about flow bits but I also think that there is an issue about file magic not being used

Actions #6

Updated by Philippe Antoine almost 3 years ago

  • Affected Versions 6.0.2 added
  • Affected Versions deleted (4.0.1, 4.1.2)
Actions #7

Updated by Philippe Antoine almost 3 years ago

  • Status changed from New to In Review
Actions #8

Updated by Philippe Antoine over 2 years ago

  • Target version changed from TBD to 7.0.0-beta1
Actions #9

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions #10

Updated by Victor Julien about 1 year ago

  • Target version changed from 7.0.0-rc1 to 8.0.0-beta1
Actions #11

Updated by Philippe Antoine 11 months ago

  • Target version changed from 8.0.0-beta1 to 7.0.1
Actions #13

Updated by Philippe Antoine 9 months ago

  • Target version changed from 7.0.1 to 7.0.0-rc2

Setting a better version than 7.0.1

Actions #14

Updated by Victor Julien 9 months ago

  • Priority changed from Normal to Low
Actions #15

Updated by Victor Julien 9 months ago

  • Target version changed from 7.0.0-rc2 to 7.0.0
Actions #16

Updated by Philippe Antoine 8 months ago

  • Target version changed from 7.0.0 to 8.0.0-beta1
Actions #17

Updated by Victor Julien 8 months ago

Actions #18

Updated by Philippe Antoine 8 months ago

  • Assignee changed from Philippe Antoine to Victor Julien

Getting fixed with #6194 by Victor

Actions #19

Updated by Victor Julien 7 months ago

  • Status changed from In Review to Closed
  • Priority changed from Low to Normal
  • Target version changed from 8.0.0-beta1 to 7.0.0

Indeed fixed by #6194.

SV test and more merged here https://github.com/OISF/suricata-verify/pull/1288

Actions #20

Updated by Victor Julien 7 months ago

  • Related to Optimization #6203: detect: modernize filename fileext filemagic (6.0.x backport) added
Actions

Also available in: Atom PDF