Project

General

Profile

Actions

Bug #3403

closed

smb1: 'event only' transactions for bad requests never close (4.1.x)

Added by Victor Julien almost 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

For certain record types in smb1 we don't create transactions, except when we need them to set a parser event.

If this happened on the request side, the tx would never complete as the response side did not mark it as complete. This could lead to a long tx list.


Related issues 2 (1 open1 closed)

Related to Suricata - Bug #3375: Tracking: file tracking/inspection performance issuesNewVictor JulienActions
Copied from Suricata - Bug #3401: smb1: 'event only' transactions for bad requests never closeClosedVictor JulienActions
Actions

Also available in: Atom PDF