Project

General

Profile

Actions

Optimization #4318

open

app-layer: "close" all txs if protocol reaches error state

Added by Shivani Bhardwaj over 1 year ago. Updated 11 days ago.

Status:
Assigned
Priority:
Low
Target version:
Effort:
high
Difficulty:
high
Label:

Description

Currently, in case there was a mis-detection of protocol or something led to incomplete data error in a protocol parser, the cleanup is not done properly.
Victor says "we should have logic that "closes" all txs (marks them as done), or handle this in the lower layers"
This came up when DCE/RPC over UDP packet was misdetected as Wireguard protocol and took too much of processing power.

Actions #1

Updated by Victor Julien over 1 year ago

  • Subject changed from Logic that "closes" all txs to app-layer: "close" all txs if protocol reaches error state
Actions #2

Updated by Victor Julien 12 months ago

  • Assignee changed from Victor Julien to Philippe Antoine
Actions #3

Updated by Philippe Antoine 12 months ago

  • Status changed from Assigned to In Review
Actions #4

Updated by Philippe Antoine 11 months ago

When an error is returned by an app-layer parser over UDP, nothing happens (the return value of AppLayerHandleUdp is ignored)
There is no equivalent of STREAMTCP_FLAG_APP_LAYER_DISABLED
Should we do something ?

Actions #5

Updated by Philippe Antoine about 1 month ago

  • Priority changed from Normal to Low
  • Effort set to high
  • Difficulty set to high
Actions #6

Updated by Philippe Antoine 13 days ago

  • Target version changed from 7.0rc1 to TBD
Actions #7

Updated by Philippe Antoine 11 days ago

  • Status changed from In Review to Assigned
Actions

Also available in: Atom PDF