Project

General

Profile

Actions

Feature #3531

closed
PA

app-layer: signal stream engine about expected data size with next character

Feature #3531: app-layer: signal stream engine about expected data size with next character

Added by Philippe Antoine about 6 years ago. Updated almost 6 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

Currently the TCP based app-layers assemble the buffer they work on themselves. This leads to unnecessary buffering and code complexity. Instead, the app-layer API should allow the parsers to signal to the stream layer below how much data they need before the record is complete.

This can be with a specified length, or with a new expected character, for instance in text protocols such as FTP where we wait for end of line.


Related issues 1 (0 open1 closed)

Related to Suricata - Feature #3444: app-layer: signal stream engine about expected data sizeClosedVictor JulienActions

PA Updated by Philippe Antoine about 6 years ago Actions #1

  • Parent task set to #3444

VJ Updated by Victor Julien about 6 years ago Actions #2

Some thoughts:
  • we should think about a limit. If the requested char does not appear in the stream, queuing should not be endless.
  • is registering a single char enough or do we have a need for registering multiple at once?

PA Updated by Philippe Antoine about 6 years ago Actions #3

Nice thoughts.

Limit is needed indeed.

A simple char may not be enough... As end of lines can get tricky (cf SSH split between CR and LF)
Maybe a callback function hasEnoughData will be more generic ?

VJ Updated by Victor Julien about 6 years ago Actions #4

  • Parent task deleted (#3444)

VJ Updated by Victor Julien about 6 years ago Actions #5

  • Related to Feature #3444: app-layer: signal stream engine about expected data size added

PA Updated by Philippe Antoine about 6 years ago Actions #6

Maybe the app layer parser can just signal to he TCP engine : this is not complete, keep buffering...
And be responsible for the limit they use...

PA Updated by Philippe Antoine almost 6 years ago Actions #7

  • Status changed from New to Rejected

Does not seem relevant

Actions

Also available in: PDF Atom