Project

General

Profile

Actions

Bug #4199

closed

Transformation keyword can’t trigger an alert

Added by yixuan fang 10 months ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 6.0

Description

I test the transformation keyword url_decode by writing 2 rules. And I get an alert by only using rule2.
However, if I using rule1 and rule2 together, then no alert occurs.

rule1:
alert http any any -> $HOME_NET any (msg:"detecting (/etc/passwd)"; flow:to_server,established; http.request_body; content:"\\\etc\\\passwd")

rule2:
alert http any any -> $HOME_NET any (msg:"detecting (/etc/passwd)"; flow:to_server,established; http.request_body; url_decode; content:"\\\etc\\\passwd")

I debug the detection part of the code and figuring out the workflow of transformation. If a rule file containing rule1 detecting a sticky buffer and rule2 detecting the sticky buffer after transformation, Suricata starts from inepecting the original sticky buffer. After this process, the sticky buffer would be flagged as "already inspected". So transformation can't be performed on this sticky buffer since it's already taken and inspected. Therefore, rule2 can't trigger any alert.

I wonder, if it's a BUG of transformation. I can't find any other useful information through the [documentation](https://suricata.readthedocs.io/en/suricata-6.0.0/rules/transforms.h).


Files

http-forum.pcap (2.03 KB) http-forum.pcap Jeff Lucovsky, 12/12/2020 01:30 PM

Related issues

Has duplicate Bug #4210: Alert not generated with 2 rules - http.request body (alone) and http.request_body/url_decodeClosedJeff LucovskyActions
Copied to Bug #4311: Transformation keyword can’t trigger an alert ClosedVictor JulienActions
Actions #1

Updated by yixuan fang 10 months ago

I test the transformation keyword url_decode by writing 2 rules. And I get an alert by only using rule2.
However, if I using rule1 and rule2 together, then no alert occurs.

rule1:
alert http any any -> $HOME_NET any (msg:"detecting (/etc/passwd)"; flow:to_server,established; http.request_body; content:"\\etc\\passwd")

rule2:
alert http any any -> $HOME_NET any (msg:"detecting (/etc/passwd)"; flow:to_server,established; http.request_body; url_decode; content:"\\etc\\passwd")

I debug the detection part of the code and figuring out the workflow of transformation. If a rule file containing rule1 detecting a sticky buffer and rule2 detecting the sticky buffer after transformation, Suricata starts from inepecting the original sticky buffer. After this process, the sticky buffer would be flagged as "already inspected". So transformation can't be performed on this sticky buffer since it's already taken and inspected. Therefore, rule2 can't trigger any alert.

I wonder, if it's a BUG of transformation. I can't find any other useful information through the [documentation](https://suricata.readthedocs.io/en/suricata-6.0.0/rules/transforms.h).

Actions #2

Updated by Jeff Lucovsky 9 months ago

Attaching pcap provided on forum

Actions #3

Updated by Jeff Lucovsky 9 months ago

  • Status changed from New to Assigned
  • Assignee changed from Victor Julien to Jeff Lucovsky
  • Target version set to 7.0rc1
  • Label Needs backport to 6.0 added
Actions #4

Updated by Victor Julien 9 months ago

  • Has duplicate Bug #4210: Alert not generated with 2 rules - http.request body (alone) and http.request_body/url_decode added
Actions #5

Updated by Jeff Lucovsky 9 months ago

  • Status changed from Assigned to In Review
Actions #6

Updated by Jeff Lucovsky 8 months ago

  • Copied to Bug #4311: Transformation keyword can’t trigger an alert added
Actions #7

Updated by Victor Julien 7 months ago

  • Assignee changed from Jeff Lucovsky to Victor Julien
Actions #8

Updated by Victor Julien 7 months ago

  • Status changed from In Review to Closed
  • Priority changed from High to Normal
Actions

Also available in: Atom PDF