Project

General

Profile

Actions

Feature #3531

closed

app-layer: signal stream engine about expected data size with next character

Added by Philippe Antoine about 4 years ago. Updated almost 4 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

Currently the TCP based app-layers assemble the buffer they work on themselves. This leads to unnecessary buffering and code complexity. Instead, the app-layer API should allow the parsers to signal to the stream layer below how much data they need before the record is complete.

This can be with a specified length, or with a new expected character, for instance in text protocols such as FTP where we wait for end of line.


Related issues 1 (0 open1 closed)

Related to Suricata - Feature #3444: app-layer: signal stream engine about expected data sizeClosedVictor JulienActions
Actions #1

Updated by Philippe Antoine about 4 years ago

  • Parent task set to #3444
Actions #2

Updated by Victor Julien about 4 years ago

Some thoughts:
  • we should think about a limit. If the requested char does not appear in the stream, queuing should not be endless.
  • is registering a single char enough or do we have a need for registering multiple at once?
Actions #3

Updated by Philippe Antoine about 4 years ago

Nice thoughts.

Limit is needed indeed.

A simple char may not be enough... As end of lines can get tricky (cf SSH split between CR and LF)
Maybe a callback function hasEnoughData will be more generic ?

Actions #4

Updated by Victor Julien about 4 years ago

  • Parent task deleted (#3444)
Actions #5

Updated by Victor Julien about 4 years ago

  • Related to Feature #3444: app-layer: signal stream engine about expected data size added
Actions #6

Updated by Philippe Antoine about 4 years ago

Maybe the app layer parser can just signal to he TCP engine : this is not complete, keep buffering...
And be responsible for the limit they use...

Actions #7

Updated by Philippe Antoine almost 4 years ago

  • Status changed from New to Rejected

Does not seem relevant

Actions

Also available in: Atom PDF