Project

General

Profile

Actions

Bug #3345

closed

App-Layer: Not all parsers register TX detect flags that should

Added by Jason Ish about 2 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport

Description

User reported slowdown in the DHCP parser. It turns out that the DHCP parser did not register tx detect flag callbacks resulting the transactions on a flow never being freed. This is particular noticeable on DHCP due to the 0.0.0.0->255.255.255.255 address pair that is used for many DHCP requests.

First fixed as an app-layer fixup to handle parsers without tx detect flags, such as DHCP that don't need them as they don't register any detection engines.

The second fix was to throw a fatal error if a detect engine is registered for an app-layer proto without tx detect flags. This should never happen in production, its more of a check during development.

Finally protocols that were missing tx detect flags that needed them were fixed up to use them.


Related issues

Copied to Bug #3356: DHCP: Slow down over time due to lack of detect flags (4.1.x)ClosedVictor JulienActions
Actions #1

Updated by Victor Julien about 2 years ago

We should also review if any other parser has the same issue. Perhaps the API should enforce it.

Actions #2

Updated by Victor Julien about 2 years ago

  • Target version set to 5.0.1
  • Label Needs backport added
Actions #3

Updated by Jason Ish about 2 years ago

Victor Julien wrote:

We should also review if any other parser has the same issue. Perhaps the API should enforce it.

Looks like most of the Rust ones (but not all).

Is there any parser where it would make sense to not have these callbacks set?

Actions #4

Updated by Jason Ish about 2 years ago

  • Copied to Bug #3356: DHCP: Slow down over time due to lack of detect flags (4.1.x) added
Actions #6

Updated by Jason Ish about 2 years ago

  • Status changed from Assigned to Closed

Merged. More of a general TX detect flags fix than a DHCP fix.

Pull request: https://github.com/OISF/suricata/pull/4405
See commits starting at: 739df21e2d87fe195a09334f66409f458711f3f8

Actions #7

Updated by Jason Ish about 2 years ago

  • Subject changed from DHCP: Slow down over time due to lack of detect flags. to App-Layer: Not all parsers register TX detect flags that should
  • Description updated (diff)
Actions

Also available in: Atom PDF