Project

General

Profile

Actions

Bug #5197

closed

fast_pattern assignment of specific content results in FN

Added by Brandon Murphy 9 months ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Consider the following two rules, designed to detect a specific answer for a DNS TXT record reply cough more dns buffers in suri7 plz! cough. The only difference is that sid:2 has a manual fast_pattern assignment.

alert dns any any -> $HOME_NET any (byte_test:1,&,128,3; content:"|00 01 00 01 00 00 00 00|"; offset:4; depth:8; content:"1"; distance:1; within:1; content:"|00 00 10 00 01|"; distance:0; content:"|00 10 00 01 00 00 00 01|"; distance:2; within:8; content:"1"; distance:3; within:1; content:"456789"; distance:2; within:6; sid:1;)
alert dns any any -> $HOME_NET any (byte_test:1,&,128,3; content:"|00 01 00 01 00 00 00 00|"; offset:4; depth:8; content:"1"; distance:1; within:1; content:"|00 00 10 00 01|"; distance:0; content:"|00 10 00 01 00 00 00 01|"; distance:2; within:8; content:"1"; distance:3; within:1; content:"456789"; distance:2; within:6; fast_pattern; sid:2;)

In testing against the attached pcap, only sid:1; fires, despite containing the exact same signature logic.

This issue is not present in Suricata 4.0.x

Suricata shows the fast_patterns for each rule as follows

-------------------------------------------------------------------
Date: 19/3/2022 -- 00:14:39
-------------------------------------------------------------------
== Sid: 1 ==
alert dns any any -> $HOME_NET any (byte_test:1,&,128,3; content:"|00 01 00 01 00 00 00 00|"; offset:4; depth:8; content:"1"; distance:1; within:1; content:"|00 00 10 00 01|"; distance:0; content:"|00 10 00 01 00 00 00 01|"; distance:2; within:8; content:"1"; distance:3; within:1; content:"456789"; distance:2; within:6; sid:1;)
    Fast Pattern analysis:
        Fast pattern matcher: content
        Flags: Within Distance
        Fast pattern set: no
        Fast pattern only set: no
        Fast pattern chop set: no
        Original content: \x00\x10\x00\x01\x00\x00\x00\x01
        Final content: \x00\x10\x00\x01\x00\x00\x00\x01

== Sid: 2 ==
alert dns any any -> $HOME_NET any (byte_test:1,&,128,3; content:"|00 01 00 01 00 00 00 00|"; offset:4; depth:8; content:"1"; distance:1; within:1; content:"|00 00 10 00 01|"; distance:0; content:"|00 10 00 01 00 00 00 01|"; distance:2; within:8; content:"1"; distance:3; within:1; content:"456789"; distance:2; within:6; fast_pattern; sid:2;)
    Fast Pattern analysis:
        Fast pattern matcher: content
        Flags: Within Distance
        Fast pattern set: yes
        Fast pattern only set: no
        Fast pattern chop set: no
        Original content: 456789
        Final content: 456789

============
Summary:
============
packet/stream payload, smallest pattern 6 byte(s), longest pattern 8 byte(s), number of patterns 2, avg pattern len 7.00 byte(s)

Files

redacted_dns.pcapng (436 Bytes) redacted_dns.pcapng Brandon Murphy, 03/19/2022 12:24 AM
f92840348b24bc49_eve.json (9.33 KB) f92840348b24bc49_eve.json Brandon Murphy, 04/10/2022 02:38 AM
7139323980e636ee_suricata.yaml (70.1 KB) 7139323980e636ee_suricata.yaml Brandon Murphy, 04/10/2022 02:38 AM

Related issues 1 (0 open1 closed)

Is duplicate of Bug #5162: inspection of smb traffic without smb/dcerpc doesn't work correct. ClosedVictor JulienActions
Actions

Also available in: Atom PDF