Project

General

Profile

Actions
Copy link

Bug #4286

open

detect: FN due to setup failure with http_cookie after isdataat

Added by Jason Taylor almost 5 years ago. Updated 10 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Affected Versions:
4.1.10
Effort:
Difficulty:
Label:
Needs Suricata-Verify test

Description

Given a sample of traffic such as:

GET /somestuff HTTP/1.1
Accept: */*
Cookie: id=234524dst35e
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0000; Windows NT 5.1; SV1)
Host: google.com

We would expect the following to work:

alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; content:"id="; depth:3; isdataat:!13,relative; http_cookie;)

However, the rule does not fire as expected in any of the 4.0.x, 4.1.x, 5.x versions I tested on.

If we switch the rule to use http.cookie, the rule works as expected.

Subtasks 1 (1 open — 0 closed)

Task #5483: SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286)In ReviewVictor JulienActions

Related issues 2 (2 open — 0 closed)

Related to Suricata - Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the ruleNewOISF DevActions
Related to Suricata - Bug #1926: rule parsing: wrong content checked for fast_pattern (snort compatibility)FeedbackOISF DevActions
Actions
Copy link
 #1

Updated by Philippe Antoine almost 5 years ago

  • Is duplicate of Bug #2479: http_cookie negation fails if no cookie in traffic added
Actions
Copy link
 #2

Updated by Victor Julien over 3 years ago

  • Is duplicate of deleted (Bug #2479: http_cookie negation fails if no cookie in traffic)
Actions
Copy link
 #3

Updated by Juliana Fajardini Reichow over 3 years ago

  • Related to Task #5483: SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286) added
Actions
Copy link
 #4

Updated by Juliana Fajardini Reichow over 3 years ago

  • Related to deleted (Task #5483: SV tests to demonstrate false negative behavior for negated isdataat with http_cookie keyword (bug 4286))
Actions
Copy link
 #5

Updated by Juliana Fajardini Reichow over 3 years ago

  • Subtask #5483 added
Actions
Copy link
 #6

Updated by Juliana Fajardini Reichow over 3 years ago

  • Related to Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule added
Actions
Copy link
 #7

Updated by Victor Julien over 2 years ago

  • Label Needs Suricata-Verify test added
Actions
Copy link
 #8

Updated by Philippe Antoine over 1 year ago

  • Target version set to TBD

If we switch the rule to use http.cookie, the rule works as expected

So, I wonder if there is anything to do...

Actions
Copy link
 #9

Updated by Philippe Antoine over 1 year ago

  • Status changed from New to Feedback
  • Assignee set to Community Ticket
Actions
Copy link
 #10

Updated by Philippe Antoine 11 months ago

@Jason Taylor could we close this ticket ?

Actions
Copy link
 #11

Updated by Victor Julien 10 days ago ยท Edited

These 2 work

http.cookie; content:"id="; depth:3; isdataat:!13,relative; sid:1;
content:"id="; depth:3; http_cookie; isdataat:!13,relative; sid:2;

Sid 1 with http.cookie works because it is a sticky buffer.
Sid 2 with http_cookie after the content works because it converts the content to the http_cookie buffer before the relative isdataat is set up and thus also added to http_cookie buffer.

This one does not:

content:"id="; depth:3; isdataat:!13,relative; http_cookie; sid:3;

Sid 3 fails because content and isdataat are initially set up for raw content / stream. The http_cookie modifier then moves only the content over to the http_cookie list, but not the isdataat.

This is related to #1926.

Actions
Copy link
 #12

Updated by Victor Julien 10 days ago

  • Subject changed from FN occurs when using negated isdataat with http_cookie keyword to detect: FN due to setup failure with http_cookie after isdataat
Actions
Copy link
 #13

Updated by Victor Julien 10 days ago

  • Description updated (diff)
Actions
Copy link
 #14

Updated by Victor Julien 10 days ago

  • Description updated (diff)
Actions
Copy link
 #16

Updated by Victor Julien 10 days ago

  • Related to Bug #1926: rule parsing: wrong content checked for fast_pattern (snort compatibility) added
Actions
Copy link

Also available in: Atom PDF