Project

General

Profile

Actions
Copy link

Bug #2836

closed

signature with filemagic do not honor flowbits

Added by Eric Leblond over 5 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
7.0.0
Affected Versions:
6.0.2
Effort:
medium
Difficulty:
high
Label:

Description

When running the following ruleset on a pcap with a PDF transfer, we have an unexpected result with sid:2 and sid:3 alerting on the same packet even if they have opposed flowbits tests 

alert http any any -> any any (msg:"Wget useragent";content:"wget"; nocase; http_user_agent; sid:1; rev:1; flowbits:set,wgetagent; noalert;)
alert http any any -> any any (msg:"PDF wget"; flowbits:isset,wgetagent; filemagic:"PDF"; flow:established,to_client; sid:2; rev:1;)
alert http any any -> any any (msg:"PDF not wget"; flowbits:isnotset,wgetagent; filemagic:"PDF"; flow:established,to_client; sid:3; rev:1;)

You can find suricata-verify test here: https://github.com/regit/suricata-verify/commits/filemagic

Suricata 3.2 was correct but Suricata 4.0.x was not. A git bisect on this range seems to show that the following patch is responsible of the issue:

commit 1bbf5553186c7d38b678f93db24773bd14ff84cf
Author: Victor Julien <victor@inliniac.net>
Date:   Tue Apr 11 15:24:49 2017 +0200

    detect: improve stateful detection

Related issues 2 (0 open — 2 closed)

Related to Suricata - Optimization #6194: detect: modernize filename fileext filemagicClosedVictor JulienActions
Related to Suricata - Optimization #6203: detect: modernize filename fileext filemagic (6.0.x backport)ClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Eric Leblond over 5 years ago

Actions
Copy link
 #2

Updated by Andreas Herz over 5 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions
Copy link
 #3

Updated by Philippe Antoine over 3 years ago

  • Assignee changed from OISF Dev to Philippe Antoine
Actions
Copy link
 #4

Updated by Philippe Antoine over 3 years ago

S-V passes with using sticky buffer file.magic instead of filemagic

Actions
Copy link
 #5

Updated by Philippe Antoine over 3 years ago

DetectFlowbitMatch is called too early for sid 3 and the flow bit is not set yet, so it matches. even if we have no file yet
Then DetectFilemagicMatch is called later

So, there may a deep issue about flow bits but I also think that there is an issue about file magic not being used

Actions
Copy link
 #6

Updated by Philippe Antoine over 3 years ago

  • Affected Versions 6.0.2 added
  • Affected Versions deleted (4.0.1, 4.1.2)
Actions
Copy link
 #7

Updated by Philippe Antoine over 3 years ago

  • Status changed from New to In Review
Actions
Copy link
 #8

Updated by Philippe Antoine over 3 years ago

  • Target version changed from TBD to 7.0.0-beta1
Actions
Copy link
 #9

Updated by Victor Julien about 2 years ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions
Copy link
 #10

Updated by Victor Julien almost 2 years ago

  • Target version changed from 7.0.0-rc1 to 8.0.0-beta1
Actions
Copy link
 #11

Updated by Philippe Antoine over 1 year ago

  • Target version changed from 8.0.0-beta1 to 7.0.1
Actions
Copy link
 #13

Updated by Philippe Antoine over 1 year ago

  • Target version changed from 7.0.1 to 7.0.0-rc2

Setting a better version than 7.0.1

Actions
Copy link
 #14

Updated by Victor Julien over 1 year ago

  • Priority changed from Normal to Low
Actions
Copy link
 #15

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.0-rc2 to 7.0.0
Actions
Copy link
 #16

Updated by Philippe Antoine over 1 year ago

  • Target version changed from 7.0.0 to 8.0.0-beta1
Actions
Copy link
 #17

Updated by Victor Julien over 1 year ago

Actions
Copy link
 #18

Updated by Philippe Antoine over 1 year ago

  • Assignee changed from Philippe Antoine to Victor Julien

Getting fixed with #6194 by Victor

Actions
Copy link
 #19

Updated by Victor Julien over 1 year ago

  • Status changed from In Review to Closed
  • Priority changed from Low to Normal
  • Target version changed from 8.0.0-beta1 to 7.0.0

Indeed fixed by #6194.

SV test and more merged here https://github.com/OISF/suricata-verify/pull/1288

Actions
Copy link
 #20

Updated by Victor Julien over 1 year ago

  • Related to Optimization #6203: detect: modernize filename fileext filemagic (6.0.x backport) added
Actions
Copy link

Also available in: Atom PDF