Bug #5057: dns: probing/parser can return error when it should return incomplete - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5057

closed

dns: probing/parser can return error when it should return incomplete

Added by Jeff Lucovsky about 2 years ago. Updated over 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

6.0.5

Affected Versions:

Effort:

Difficulty:

Label:

Description

The hostname parsing in the DNS parser will return an error when it runs out of data instead of incomplete. This can result in a specially crafted DNS payload not being detected as DNS.

Suricata-Verify test showing DNS stream being picked up as ENIP:
https://github.com/OISF/suricata-verify/pull/676

Fix with master (nom7) is trivially done by moving error handling to the question mark operator. Its likely the same is true for 5.0.x and 6.0.x. This will probably ripple up incomplete or error up the parse chain.

Related issues 1 (0 open — 1 closed)