Project

General

Profile

Actions

Bug #3746

closed

bsize needs to err upon non possible matching conditions (4.1.x)

Added by Jeff Lucovsky over 2 years ago. Updated almost 2 years ago.

Status:
Rejected
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The following does not err (but it should)

cat bsize.rules 

alert http any any -> any any (msg:"bsize test TEST"; http.uri; content:"abcdefgh123456"; bsize:2; sid:111; rev:1;)

/opt/suritest/bin/suricata -l log/ -S bsize.rules --engine-analysis  ; cat log/rules_analysis.txt
[693058] 27/4/2020 -- 22:19:00 - (suricata.c:1056) <Notice> (LogVersion) -- This is Suricata version 6.0.0-dev (eef776087 2020-04-27) running in USER mode
-------------------------------------------------------------------
Date: 27/4/2020 -- 22:19:00
-------------------------------------------------------------------
== Sid: 111 ==
alert http any any -> any any (msg:"bsize test TEST"; http.uri; content:"abcdefgh123456"; bsize:2; sid:111; rev:1;)
    Rule matches on http uri buffer.
    App layer protocol is http.
    Rule contains 0 content options, 1 http content options, 0 pcre options, and 0 pcre options with http modifiers.
    Fast Pattern "abcdefgh123456" on "http request uri (http_uri)" buffer.
    Warning: TCP rule without a flow or flags option.
             -Consider adding flow or flags to improve performance of this rule.

/opt/suritest/bin/suricata -l log/ -S bsize.rules -T
[693188] 27/4/2020 -- 22:21:40 - (suricata.c:1582) <Info> (ParseCommandLine) -- Running suricata under test mode
[693188] 27/4/2020 -- 22:21:40 - (suricata.c:1056) <Notice> (LogVersion) -- This is Suricata version 6.0.0-dev (eef776087 2020-04-27) running in SYSTEM mode
[693188] 27/4/2020 -- 22:21:41 - (suricata.c:2752) <Notice> (SuricataMain) -- Configuration provided was successfully loaded. Exiting.

If urilen:2 is added it errors properly

[693684] 27/4/2020 -- 22:38:21 - (suricata.c:1582) <Info> (ParseCommandLine) -- Running suricata under test mode
[693684] 27/4/2020 -- 22:38:21 - (suricata.c:1056) <Notice> (LogVersion) -- This is Suricata version 6.0.0-dev (eef776087 2020-04-27) running in SYSTEM mode
[693684] 27/4/2020 -- 22:38:21 - (detect-urilen.c:356) <Error> (DetectUrilenValidateContent) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - depth or urilen 2 smaller than content len 14
[693684] 27/4/2020 -- 22:38:21 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http any any -> any any (msg:"bsize test TEST"; http.uri; content:"abcdefgh123456"; urilen:2; sid:111; rev:1;)" from file bsize.rules at line 3
[693684] 27/4/2020 -- 22:38:21 - (detect-engine-loader.c:347) <Warning> (SigLoadSignatures) -- [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - 1 rule files specified, but no rules were loaded!
[693684] 27/4/2020 -- 22:38:21 - (suricata.c:2154) <Error> (LoadSignatures) -- [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - Loading signatures failed.


Related issues 1 (1 open0 closed)

Copied from Bug #3682: bsize needs to err upon non possible matching conditionsIn ReviewJeff LucovskyActions
Actions #1

Updated by Jeff Lucovsky over 2 years ago

  • Copied from Bug #3682: bsize needs to err upon non possible matching conditions added
Actions #2

Updated by Shivani Bhardwaj about 2 years ago

  • Status changed from Assigned to In Review
Actions #3

Updated by Victor Julien about 2 years ago

  • Status changed from In Review to Closed
Actions #4

Updated by Victor Julien about 2 years ago

  • Subject changed from bsize needs to err upon non possible matching conditions to bsize needs to err upon non possible matching conditions (4.1.x)
  • Status changed from Closed to Assigned
  • Target version changed from 4.1.9 to TBD

Not yet fixed in master, so waiting for that for the backport.

Actions #5

Updated by Shivani Bhardwaj almost 2 years ago

  • Status changed from Assigned to Rejected
Actions #6

Updated by Shivani Bhardwaj almost 2 years ago

The release happened without this feature in master so it could not have been backported then. Now, 4.1.x is EOL.
The original issue is supposed to be released in 7.0beta1.

Actions

Also available in: Atom PDF