Project

General

Profile

Actions

Bug #5168

closed

detect/iponly: non-cidr netmask settings can lead incorrect detection

Added by Victor Julien over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

A rule like alert ip any any -> 0.0.0.5/0.0.0.5 any (sid:1;) fails to work properly, hits a DEBUG_VALIDATE_BUG_ON and leaks memory.

The engine internally only correctly handles netmasks that can be expressed through the CIDR notation as well.

(From: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)


Files

cidr-table.png (146 KB) cidr-table.png Victor Julien, 03/03/2022 07:33 AM

Related issues 3 (0 open3 closed)

Related to Suricata - Bug #5081: detect/iponly: rule parsing does not always apply netmask correctlyClosedVictor JulienActions
Copied to Suricata - Bug #5170: detect/iponly: non-cidr netmask settings can lead incorrect radix treeClosedShivani BhardwajActions
Copied to Suricata - Bug #5171: detect/iponly: non-cidr netmask settings can lead incorrect radix treeClosedJeff LucovskyActions
Actions #1

Updated by Victor Julien over 2 years ago

  • Related to Bug #5081: detect/iponly: rule parsing does not always apply netmask correctly added
Actions #2

Updated by Jeff Lucovsky over 2 years ago

  • Copied to Bug #5170: detect/iponly: non-cidr netmask settings can lead incorrect radix tree added
Actions #3

Updated by Jeff Lucovsky over 2 years ago

  • Copied to Bug #5171: detect/iponly: non-cidr netmask settings can lead incorrect radix tree added
Actions #4

Updated by Victor Julien over 2 years ago

  • File Screenshot from 2022-03-03 08-28-05.png added
  • Subject changed from detect/iponly: non-cidr netmask settings can lead incorrect radix tree to detect/iponly: non-cidr netmask settings can lead incorrect detection
  • Description updated (diff)
Actions #5

Updated by Victor Julien over 2 years ago

  • Description updated (diff)
Actions #6

Updated by Victor Julien over 2 years ago

Actions #7

Updated by Victor Julien over 2 years ago

  • File deleted (Screenshot from 2022-03-03 08-28-05.png)
Actions #8

Updated by Victor Julien over 2 years ago

  • Status changed from In Progress to Closed
Actions

Also available in: Atom PDF